B}$ respectively, as Alice and Bob cannot discard this case. Most importantly, [*Protocol*]{} $1$ allows Alice and Bob to defeat covert channels such as memory attacks in QKD, as this protocol guarantees that none of the corrupted QKD modules can access $k_{\rm A}$ or $k_{\rm B}$. Our results are summarised in the following Claim, whose proof is direct from the definition of [*Protocol*]{} $1$.\
[**Claim 1.**]{} [*Suppose that Alice and Bob have $n$ pairs of QKD modules and up to $t<n$ of them could be corrupted. Also, suppose that they have one trusted classical post-processing unit each. Let $M\leq{}n$ denote the number of pairs of QKD modules that do not abort and whose raw key could in principle be transformed into an $(\epsilon/n)$-secure key, and let $N$ bits be the length of such supposedly secure key. Protocol $1$ allows Alice and Bob to distill an $\epsilon$-secure key of length $(M-t)\times{}N$ bits. Moreover, the re-use of the devices does not compromise the security of the keys distilled in previous QKD runs.* ]{}\
Importantly, we remark that [*Protocol*]{} $1$ is optimal with respect to the resulting secret key rate. This is so because of the following. If no pair of QKD modules 