Abstract: A trusted computing system includes a computer, responsive to signals applied to its keyboard port. The system includes a keyboard for generating signals representing keystrokes. A card reader is coupled to the keyboard and to the computer keyboard port. The card reader couples one of a plurality of removable access control cards to the keyboard and to the computer keyboard port. Each of the access cards includes memory for storing personal identification information of the user to whom the card is issued. Within the card, a comparator is coupled to the memory, for, in a first operating mode, comparing the keyboard signals with the personal identification information stored in the card memory, and for, when the comparator matches the keyboard signals with the personal identification information, switching to a second operating mode, in which it couples the keyboard to the keyboard port of the computer.