A device includes one or more communication interfaces that communicate via at least one link or a network; a device memory; a device processing unit; and a Trusted Execution Environment (TEE) that is secure from the device processing unit and the device memory. The TEE obtains a public encryption key and a private encryption key pair, stores the private encryption key in a secure memory in the Trusted Execution Environment (TEE), and executes a first trusted application, within the TEE, to perform a PKI function using the private encryption key.