a method and system for securely enrolling personal identity credentials into personal identification devices . the system of the invention comprises the manufacturer of the device and an enrollment authority . the manufacturer is responsible for recording serial numbers or another unique identifier for each device that it produces , along with a self - generated public key for each device . the enrollment authority is recognized by the manufacturer or another suitable institution as capable of validating an individual before enrolling him into the device . the enrollment authority maintains and operates the appropriate equipment for enrollment , and provides its approval of the enrollment . the methods described herein discuss post - manufacturing , enrollment , backup , and recovery processes for the device .