A hearing device comprising - a processing unit configured to compensate for hearing loss of a user of the hearing device; - a memory unit ; and - an interface , wherein the hearing device is configured to operate according to security settings of the hearing device, the security settings of the hearing device being stored in the memory unit , characterized in that the security settings comprise primary security settings including a hearing device certificate , the hearing device certificate comprising a plurality of hearing device keys and a first hearing device key identifier , and wherein the processing unit is configured to - obtain new security settings via the interface, the new security settings comprising a new first hearing device key identifier indicative of a hearing device key; - verify the new security settings based on the primary security settings of the hearing device, wherein to verify the new security settings comprises to validate the new first hearing device key identifier, wherein to verify the new security settings comprises to determine if the new first hearing device key identifier is valid based on the first hearing device key identifier , wherein the new first hearing device key identifier is not valid if the new first hearing device key identifier is smaller than the first hearing device key identifier of the hearing device certificate; and - update, if the new security settings are verified, the security settings of the hearing device based on the new security settings , wherein to update the security settings of the hearing device comprises to include the new first hearing device key identifier in the security settings of the hearing device by storing the new first hearing device key identifier as a current first hearing device key identifier in secondary security settings of the security settings . - a processing unit configured to compensate for hearing loss of a user of the hearing device; - a memory unit ; and - an interface , - obtain new security settings via the interface, the new security settings comprising a new first hearing device key identifier indicative of a hearing device key; - verify the new security settings based on the primary security settings of the hearing device, wherein to verify the new security settings comprises to validate the new first hearing device key identifier, wherein to verify the new security settings comprises to determine if the new first hearing device key identifier is valid based on the first hearing device key identifier , wherein the new first hearing device key identifier is not valid if the new first hearing device key identifier is smaller than the first hearing device key identifier of the hearing device certificate; and - update, if the new security settings are verified, the security settings of the hearing device based on the new security settings , wherein to update the security settings of the hearing device comprises to include the new first hearing device key identifier in the security settings of the hearing device by storing the new first hearing device key identifier as a current first hearing device key identifier in secondary security settings of the security settings . <EOS>