1. A method utilizing a system comprising a processor and a memory encoded with program instructions that, when executed by the processor, cause the processor to perform the method, the method comprising: receiving a load module and an associated specification; verifying that the load module performs as specified by the specification; determining that the load module does not include harmful functionality; conditionally digitally signing the load module based at least in part on results of the verifying and determining steps; and distributing, to a remote protected processing environment, a digital signature generated by the step of digitally signing the load module, the remote protected processing environment being operable to perform an authentication step on the digital signature using a public key, and to conditionally execute the load module based at least in part on a result of the authentication step, wherein the remote protected processing environment is resistant to tampering by an owner of an electronic appliance upon which the remote protected processing environment is running and is operable to maintain the public key as a secret from the owner of the electronic appliance.