A wireless device comprising: one or more antennas; an embedded Universal Integrated Circuit Card , eUICC, communicatively coupled to the one or more antennas, the eUICC comprising a processor and a memory communicatively coupled to the processor and storing instructions that, when executed by the processor, cause the eUICC to perform operations comprising: providing, to a server via the wireless device, a request to establish a secure connection with the server, wherein the server is associated with a long-term server public key, PK server , provided by the server to the wireless device, and a long-term server private key, SK server , providing to the server via the wireless device: i) a signature produced using a long-term eUICC public key, PK eUICC , and ii) PK eUICC , authenticating the server using PK server , generating , subsequent to the authenticating, an ephemeral eUICC public key, ePK eUICC , and an ephemeral eUICC private key, eSK eUICC , providing , to the server via the wireless device, a signed ePK eUICC that is signed using a long-term eUICC private key, SK eUICC , receiving, from the server via the wireless device, an ephemeral server public key, ePK server , that is signed using using SK server , generating a shared symmetric key using eSK eUICC and ePK server , and establishing the secure connection with the server using the shared symmetric key. one or more antennas; an embedded Universal Integrated Circuit Card , eUICC, communicatively coupled to the one or more antennas, the eUICC comprising a processor and a memory communicatively coupled to the processor and storing instructions that, when executed by the processor, cause the eUICC to perform operations comprising: providing, to a server via the wireless device, a request to establish a secure connection with the server, wherein the server is associated with a long-term server public key, PK server , provided by the server to the wireless device, and a long-term server private key, SK server , providing to the server via the wireless device: i) a signature produced using a long-term eUICC public key, PK eUICC , and ii) PK eUICC , authenticating the server using PK server , generating , subsequent to the authenticating, an ephemeral eUICC public key, ePK eUICC , and an ephemeral eUICC private key, eSK eUICC , providing , to the server via the wireless device, a signed ePK eUICC that is signed using a long-term eUICC private key, SK eUICC , receiving, from the server via the wireless device, an ephemeral server public key, ePK server , that is signed using using SK server , generating a shared symmetric key using eSK eUICC and ePK server , and establishing the secure connection with the server using the shared symmetric key. providing, to a server via the wireless device, a request to establish a secure connection with the server, wherein the server is associated with a long-term server public key, PK server , provided by the server to the wireless device, and a long-term server private key, SK server , providing to the server via the wireless device: i) a signature produced using a long-term eUICC public key, PK eUICC , and ii) PK eUICC , authenticating the server using PK server , generating , subsequent to the authenticating, an ephemeral eUICC public key, ePK eUICC , and an ephemeral eUICC private key, eSK eUICC , providing , to the server via the wireless device, a signed ePK eUICC that is signed using a long-term eUICC private key, SK eUICC , receiving, from the server via the wireless device, an ephemeral server public key, ePK server , that is signed using using SK server , generating a shared symmetric key using eSK eUICC and ePK server , and establishing the secure connection with the server using the shared symmetric key. <EOS>