Justin Samuel, Nick Mathewson, Justin Cappos, Roger Dingledine: Survivable key compromise in software update systems. CCS 2010: 61-72