1. A method, comprising: retrieving, by a computing device, a manifest stored in protected storage of the computing device, wherein the manifest comprises an expected measurement for an operating system loader; measuring and verifying, by the computing device, integrity of a virtual machine monitor of the computing device; launching, by the computing device, via the virtual machine monitor, one or more integrity services; launching, by the computing device, via the virtual machine monitor, a user partition to execute the operating system loader; establishing, by the computing device, a protected memory channel between the launched one or more integrity services and the operating system loader of the user partition; measuring and verifying, by the computing device, the operating system loader, with the launched one or more integrity services, via the protected memory channel, wherein the measuring and verifying is based at least in part upon the expected measurement of operating system loader in the manifest; and after successfully measuring and verifying the OS loader, launching, by the computing device, via the virtual machine monitor, the OS loader in the user partition.