1. A method comprising: by a computing device, authenticating a manifest signature with a manifest signature public key, wherein the manifest signature is used to sign a manifest; by the computing device, reading the manifest from a manifest partition on a memory of the computing device; by the computing device, choosing, from a plurality of system images stored in a plurality of system image partitions on the memory of the computing device, respectively, one system image to boot into based on information in the manifest; by the computing device, verifying that a hash value of the chosen system image matches a system image hash value in the manifest; and by the computing device, yielding a system execution control to a system kernel programmed in the chosen system image.