1. A computer-implemented method, comprising: under the control of one or more computer systems that execute instructions, obtaining a first version of a domain trust, the first version of the domain trust specifying: a set of security modules authorized to perform cryptographic operations; a set of operators; and a set of quorum rules specifying one or more conditions for a plurality of operators in a subset of the set of operators being authorized to update the domain trust; obtaining a second version of the domain trust, the second version of the domain trust digitally signed by a first security module; and as a result of the first security module being outside of the set of security modules specified by the first version of the domain trust, updating to the second version of the domain trust on a condition that the second version of the domain trust is cryptographically verified as a valid successor of the first version of the domain trust, the second version of the domain trust being a valid successor to the first version of the domain trust as a result of being in a chain of domain trust versions including the first version of the domain trust, where each domain trust version in the chain of domain trust versions is generated in compliance with the set of quorum rules of an immediately preceding domain trust version.