A method performed by a device , the method comprising: establishing a telecommunication link between the device and a service provider system via a telecommunication network, wherein the establishing of the telecommunication link comprises the device sending, via the telecommunication network, a communication with destination information indicative of the service provider system and, in response to sending the communication, the device receiving a further communication from the service provider system via the telecommunication network; sending a device certificate via the telecommunication network from the device to the service provider system, the device certificate including a device public key, a device identity that identifies the device , and a digital signature, the device public key predating the establishing of the telecommunication link, the device public key corresponding to a device private key stored in secure memory of the device, the device public key and the device private key being a cryptographic key pair, the device certificate further including an indication that the device private key is stored in the secure memory of the device; and receiving , at the device and in response to sending the device certificate to the service provider system, an authorization from the service provider system to sign up the device for service enrolment, wherein the authorization to sign up the device for the service enrolment for the service provider system comprises a service-provider-specific custom certificate provided to the device by the service provider system conditional on the indication having indicated that the device private key is stored in the secure memory of the device. establishing a telecommunication link between the device and a service provider system via a telecommunication network, wherein the establishing of the telecommunication link comprises the device sending, via the telecommunication network, a communication with destination information indicative of the service provider system and, in response to sending the communication, the device receiving a further communication from the service provider system via the telecommunication network; sending a device certificate via the telecommunication network from the device to the service provider system, the device certificate including a device public key, a device identity that identifies the device , and a digital signature, the device public key predating the establishing of the telecommunication link, the device public key corresponding to a device private key stored in secure memory of the device, the device public key and the device private key being a cryptographic key pair, the device certificate further including an indication that the device private key is stored in the secure memory of the device; and receiving , at the device and in response to sending the device certificate to the service provider system, an authorization from the service provider system to sign up the device for service enrolment, wherein the authorization to sign up the device for the service enrolment for the service provider system comprises a service-provider-specific custom certificate provided to the device by the service provider system conditional on the indication having indicated that the device private key is stored in the secure memory of the device. <EOS>