trusted and located in secure labs. In this regard, our work suggests that when the classical post-processing units at the key distillation layer are untrusted, they should not output the final key $k_{\rm A}$ and $k_{\rm B}$ but they should output shares of it to the key management layer [@kmang1; @kmang2]. There, $k_{\rm A}$ and $k_{\rm B}$ could be either reconstructed by say Alice and Bob in secure labs, or its shares could be stored in distributed memories for later use, or they could be employed for instance for encryption purposes via say the one-time pad. Importantly, however, all the key generation process at the key distillation layer can be performed with corrupted devices. Also, we note that, if necessary, operations like storage or encryption at the key management layer could also be performed with corrupted devices by using techniques from secure multiparty computation [@book_smc]. In any case, the actual management and storage of the shares of $k_{\rm A}$ and $k_{\rm B}$ generated by the key distillation layer is responsibility of the key management layer and depends on the particular application.

Before we address specific scenarios in detail, let us provide an overview of the general strategy that we follow 