Anonymous device authentication

An electronic device configured to perform operations comprising:

• accessing, by the electronic device, data stored by the electronic device that identifies authentication keys the electronic device accepts as valid;
• sending, by the electronic device to a second electronic device, an authentication request that identifies a set of authentication keys including at least some of the authentication keys the electronic device accepts as valid;
• receiving, by the electronic device, response data that the second electronic device provides in response to the authentication request, wherein the response data (i) identifies a particular authentication key from the set of authentication keys identified by the authentication request, and (ii) includes a signature generated using the particular authentication key;
• and
• authenticating, by the electronic device, the second electronic device by determining that the received signature was generated using the particular authentication key.

One or more non-transitory computer-readable media storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• accessing, by the electronic device, data stored by the electronic device that identifies authentication keys the electronic device accepts as valid;
• sending, by the electronic device to a second electronic device, an authentication request that identifies a set of authentication keys including at least some of the authentication keys the electronic device accepts as valid;
• receiving, by the electronic device, response data that the second electronic device provides in response to the authentication request, wherein the response data (i) identifies a particular authentication key from the set of authentication keys identified by the authentication request, and (ii) includes a signature generated using the particular authentication key;
• and
• authenticating, by the electronic device, the second electronic device by determining that the received signature was generated using the particular authentication key.