1. A non-transitory computer-readable storage medium comprising program code, the program code being operable, when executed by a computer system, to cause the computer system to perform steps comprising: testing a load module to determine if the load module performs as specified by a specification associated with the load module and determine if the load module would be harmful to a system when executed by the system; wherein the specification identifies the load module and describes the functions of the load module, digitally signing the load module using a first key to yield a first digital signature when it is determined that the load module performs as specified by the specification and would not be harmful to a system when executed by the system; digitally signing a second load module using a second key to yield a second digital signature when it is determined that the second load module performs as specified by the specification and would not be harmful to a system if executed by the system; distributing at least the first digital signature to a first remote electronic appliance comprising a first protected processing environment operable to authenticate the first digital signature before the first remote electronic appliance executes the load module, wherein the load module, when executed by the first remote electronic appliance, causes the first remote electronic appliance to perform at least one action on a first electronic content; and, distributing at least the second digital signature to a second remote electronic appliance comprising a second protected processing environment operable to authenticate the second digital signature before the second remote electronic appliance executes the second load module, wherein the second load module, when executed by the second remote electronic appliance, causes the second remote electronic appliance to perform at least one action on a second electronic content.