Key protection for computing platform

A security accelerator device, comprising:

• execution hardware including at least one processor core, and non-volatile data storage hardware, wherein the data storage hardware includes:
• a first credential that is uniquely associated with the security accelerator device and represents a root of trust to a trusted entity;
• and
• instructions that, when executed by the execution hardware, cause the security accelerator device to:
• establish a cryptographic trust relationship with a client entity that is based on the root of trust, the cryptographic trust relationship being represented by a second credential;
• receive and store a secret client credential of the client entity, wherein the secret client credential is received from the client entity via communication secured by the second credential;
• and
• execute a cryptographic computation using the secret client credential on behalf of the client entity to produce a computation result.