The theoretical existence of photon-number-splitting attacks creates a security loophole for most quantum key distribution (QKD) demonstrations that use a highly attenuated laser source. Using ultralow-noise, high-efficiency transition-edge sensor photodetectors, we have implemented the first version of a decoy-state protocol that incorporates finite statistics without the use of Gaussian approximations in a one-way QKD system, enabling the creation of secure keys immune to photon-number-splitting attacks and highly resistant to Trojan horse attacks over 107 km of optical fiber.