1. An apparatus comprising: a processor; and memory coupled with the processor, with instructions stored therein, wherein the instructions are to be operated by the processor to cause the apparatus to: provide a virtual machine root-of-trust for measurement (vRTM) in a secure enclave of the apparatus; provide a virtual machine trusted platform module (vTPM) for a guest virtual machine (VM) of the apparatus, the vTPM being provided in a first enclave of the apparatus different from the secure enclave; initiate a chain of integrity measurements between the vRTM and a resource of the guest VM; receive, at the vTPM, a command to change a value stored in a platform configuration register (PCR) of the vTPM; and change the value stored in the PCR in response to a modifier indicating that the command is allowed, wherein the command comprises a command to extend the value stored in the PCR with a cryptographic hash of an integrity measurement of a VM resource associated with the PCR.