up to $t'<s/3$ units CP$_{{\rm A}i'}$ and $t''<r/3$ units CP$_{{\rm B}i''}$ could be corrupted. The goal is to distill shares of an $\epsilon$-secure key, $k_{\rm A}$ and $k_{\rm B}$. In the figure, the thin red solid lines represent secure classical channels, the thin red dashed lines denote authenticated classical channels, and the blue thick dashed lines are quantum channels. [**(b)**]{} General strategy to distill shares of $k_{\rm A}$ and $k_{\rm B}$. First, each pair QKD$_{{\rm A}i}$ and QKD$_{{\rm B}i}$ outputs a raw key, $k'_{{\rm A}i}$ and $k'_{{\rm B}i}$, together with the protocol information, and sends them to the CP units at Alice and Bob’s side respectively. From $k'_{{\rm A}i}$ and $k'_{{\rm B}i}$, these units distill a supposedly $(\epsilon/n)$-secure key, $k''_{{\rm A}i}$ and $k''_{{\rm B}i}$, and then concatenate these keys to form $k'_{\rm A}=[k''_{{\rm A}1}, k''_{{\rm A}2}, \ldots, k''_{{\rm A}n}]$ and $k'_{\rm B}=[k''_{{\rm B}1}, k''_{{\rm B}2}, \ldots, k''_{{\rm B}n}]$. Finally, the CP units apply privacy amplification to $k'_{\rm A}$ and $k'_{\rm B}$ to remove the information held by the corrupted QKD modules and obtain $k_{\rm A}$ and $k_{\rm B}$. In the presence of corrupted CP units, all these steps are realised in a distributed setting by acting on data shares generated 