1. A method in a user device, comprising: storing a plurality of credentials policies; merging the credentials policies to generate a merged credentials policy; receiving an instruction from a trusted service to initiate a device credentials change; and generating a new device credentials based at least on the merged credentials policy.