1. One or more computer-readable media having stored thereon instructions for establishing a boot domain on a client computer that, when executed by one or more processors, cause the one or more processors to: select a boot certificate associated with the boot domain; create a verified operating system identity from the boot certificate; and load each one of a plurality of operating system components in accordance with a set of boot rules based on the boot certificate, wherein each of the plurality of operating system components is associated with a component certificate and the set of boot rules comprises: verifying that each component certificate is signed by a boot authority that issued the boot certificate; verifying that each component certificate is valid as of an issue date for the boot certificate; and verifying that each component is not listed in a revocation list associated with the boot certificate.