Moreover, suppose for the moment that the classical post-processing units are trusted and they distill a supposedly $(\epsilon/n)$-secure key, $k''_{{\rm A}i}$ and $k''_{{\rm B}i}$, of length $N$ bits from each pair $k'_{{\rm A}i}$ and $k'_{{\rm B}i}$. Then, we have that the $n\times{}N$ bit strings $k'_{\rm A}=[k''_{{\rm A}1},\ldots, k''_{{\rm A}n}]$ and $k'_{\rm B}=[k''_{{\rm B}1},\ldots, k''_{{\rm B}n}]$ are for certain $\epsilon_{\rm cor}$-correct. The secrecy condition, however, only holds if all the QKD modules are trusted. If say the pair QKD$_{{\rm A}i'}$ and QKD$_{{\rm B}i'}$ is corrupted then the key strings $k''_{{\rm A}i'}$ and $k''_{{\rm B}i'}$ are compromised. So, given that $t<n$ the classical post-processing units can apply privacy amplification to $k'_{\rm A}$ and $k'_{\rm B}$ to extract two shorter $(n-t)\times{}N$ bit strings, $k_{\rm A}$ and $k_{\rm B}$, which are for certain $\epsilon_{\rm sec}$-secret and thus $\epsilon$-secure. In the presence of untrusted classical post-processing units, this process can be performed in a distributed manner by acting on data shares, just as we describe above.

In short, the general strategy can be decomposed in three main steps, which are illustrated in Fig. \[fig\_gen\](b). First, each pair of QKD modules generates a raw key and the protocol information and sends them to the CP units. 