1. A method for updating code in an executing environment comprising: identifying an updater associated with new chain-of-trust code; measuring an identifying characteristic of the identified updater and making the identifying measurement of the updater available to an attestation system; installing the new chain-of-trust code into the executing environment; measuring an identifying characteristic of the new chain-of-trust code and making it available to the attestation system; notifying the attestation system that the chain-of-trust code has been updated to a new version; attesting, by the attestation system, the identifying characteristic of the new chain-of-trust code against a pre-stored attestation value; and in response to the attestation system matching the identifying characteristic of the new chain-of-trust code against a pre-stored attestation value of the new chain-of-trust code or matching the identifying characteristic of the updater against a pre-stored attestation value of the updater, validating the integrity of the updated code in the executing environment; and in response to the attestation system not matching the identifying characteristic of the new chain-of-trust code against the pre-stored attestation value of the new chain-of-trust code and not matching the identifying characteristic of the updater against the pre-stored attestation value of the updater, invalidating the integrity of the updated chain-of-trust code in the executing environment by indicating a fail indication.