Secure Key Exchange

A non-transitory computer readable medium having program instructions stored therein that are executable by a computing system implementing a first participant authority to cause the computing system to perform operations comprising:

• receiving, from a first device, a request for the first participant authority to issue a signed attestation indicating that a public key of the first device belongs to a member of a first device group authorized to participate in a key exchange with members of a second device group;
• determining whether the first device is a member of the first device group including verifying a key authorization data structure issued by a key authority, wherein the key authorization data structure includes a first public key of the first participant authority authorized to identify members of the first device group and a second public key of a second participant authority authorized to identify members of the second device group;
• and
• based on the determining, providing, to the first device, the attestation signed by a first private key corresponding to the first public key of the first participant authority.

A non-transitory computer readable medium having program instructions stored therein that are executable by a computing system implementing a key authority to cause the computing system to perform operations comprising:

• receiving a request for the key authority to authorize performance of key exchanges between a first device group and a second device group;
• signing, by the key authority, a key authorization data structure that includes a first public key of a first participant authority authorized to identify members of the first device group and a second public key of a second participant authority authorized to identify members of the second device group;
• and
• providing the signed key authorization data structure to the first and second participant authorities to authorize performance of key exchanges between members of the first and second device groups.