A system of a service provider, comprising: one or more processors; and memory storing modules (226, 228, 232) that, when executed by the one or more processors, cause the system to perform operations comprising: determining that a remote device (202, 216) is to receive a software update; identifying a public storage root key, SRK, associated with the remote device (202, 216); determining a first set of platform configuration registers, PCRs, associated with a trusted operation of firmware operating on the remote device (202, 216); determining a second set of PCRs associated with an expected operation of at least a portion of the software update on the remote device (202, 216); determining a random symmetric key, RSK; encrypting, as an encrypted software package, the software update using the RSK; encrypting, as encrypted configuration settings, the first set of PCRs and the second set of PCRs using the RSK; encrypting, as an encrypted RSK, the RSK with the public SRK of the remote device (202, 216); and transferring the encrypted software package, the encrypted configuration settings, and the encrypted RSK to the remote device (202, 216), wherein at least a portion of the encrypted software package is imported by the remote device (202, 216) based at least in part on a private SRK of the remote device (202, 216). one or more processors; and memory storing modules (226, 228, 232) that, when executed by the one or more processors, cause the system to perform operations comprising: determining that a remote device (202, 216) is to receive a software update; identifying a public storage root key, SRK, associated with the remote device (202, 216); determining a first set of platform configuration registers, PCRs, associated with a trusted operation of firmware operating on the remote device (202, 216); determining a second set of PCRs associated with an expected operation of at least a portion of the software update on the remote device (202, 216); determining a random symmetric key, RSK; encrypting, as an encrypted software package, the software update using the RSK; encrypting, as encrypted configuration settings, the first set of PCRs and the second set of PCRs using the RSK; encrypting, as an encrypted RSK, the RSK with the public SRK of the remote device (202, 216); and transferring the encrypted software package, the encrypted configuration settings, and the encrypted RSK to the remote device (202, 216), wherein at least a portion of the encrypted software package is imported by the remote device (202, 216) based at least in part on a private SRK of the remote device (202, 216). determining that a remote device (202, 216) is to receive a software update; identifying a public storage root key, SRK, associated with the remote device (202, 216); determining a first set of platform configuration registers, PCRs, associated with a trusted operation of firmware operating on the remote device (202, 216); determining a second set of PCRs associated with an expected operation of at least a portion of the software update on the remote device (202, 216); determining a random symmetric key, RSK; encrypting, as an encrypted software package, the software update using the RSK; encrypting, as encrypted configuration settings, the first set of PCRs and the second set of PCRs using the RSK; encrypting, as an encrypted RSK, the RSK with the public SRK of the remote device (202, 216); and transferring the encrypted software package, the encrypted configuration settings, and the encrypted RSK to the remote device (202, 216), wherein at least a portion of the encrypted software package is imported by the remote device (202, 216) based at least in part on a private SRK of the remote device (202, 216).