1. A method implemented by a first endpoint, the first endpoint comprising a data processing apparatus, the method comprising: receiving a message, in a connection establishment transaction, from a second endpoint, the message comprising an endpoint discriminator that is based on an identity object; selecting a certificate based on one or more attributes of the endpoint discriminator; determining a cryptographic scheme based on the selected certificate; and establishing the requested connection with the second endpoint using the selected certificate and the determined cryptographic scheme, wherein the establishing comprises: selectively using a key associated with a static public key when the selected certificate includes the static public key, the static public key being in accordance with the determined cryptographic scheme; selectively generating an ephemeral public key in accordance with the determined cryptographic scheme when the selected certificate does not include a static public key; and selectively sending the ephemeral public key to the second endpoint when the selected certificate does not include a static public key.