A first public key associated with a first recipient is requested from a server. The first public key is received, as is an associated first key reference value. The first public key is used in conjunction with securing a first message. The first public key is destroyed. A second public key associated with the first recipient is requested from the server. A second public key and an associated second key reference value are received. The second public key is different from the first public key and the first key reference value is different from the second key reference value. The second public key is used in conjunction with the securing of a second message and the second public key is destroyed.