A system for secure boot on a mobile platform, comprising: a host processor configured to execute a host operating system and host applications; firmware for booting the host processor, the Firmware to utilize one or more signature keys during boot, each signature key associated with a software image to be loaded on the platform during boot, wherein the one or more signature keys comprise at least one of a platform key, a protected variable key, or a public key; a security processor on the platform configured to manage the one or more signature keys to control image loading during boot; a secure memory store communicatively coupled to the security processor to store the firmware for booting the host processor, the secure memory store is accessible to the security processor and inaccessible to the host processor; and wherein the security processor is further configured to: (i) determine whether the firmware for booting the host processor is digitally signed and authorized to be loaded on the host processor, and (ii) copy the firmware for booting the host processor to a memory store accessible to the host processor in response to a determination that the firmware for booting the host processor is digitally signed and authorized to be loaded on the host processor, the memory store accessible to the host processor is different from the secure memory store accessible to the security processor; wherein the firmware will not load or launch the software image if the signature key associated with the software image fails validation, and wherein validation failure is a result of at least one of an expired certificate, a missing certificate or a revoked certificate. a host processor configured to execute a host operating system and host applications; firmware for booting the host processor, the Firmware to utilize one or more signature keys during boot, each signature key associated with a software image to be loaded on the platform during boot, wherein the one or more signature keys comprise at least one of a platform key, a protected variable key, or a public key; a security processor on the platform configured to manage the one or more signature keys to control image loading during boot; a secure memory store communicatively coupled to the security processor to store the firmware for booting the host processor, the secure memory store is accessible to the security processor and inaccessible to the host processor; and wherein the security processor is further configured to: (i) determine whether the firmware for booting the host processor is digitally signed and authorized to be loaded on the host processor, and (ii) copy the firmware for booting the host processor to a memory store accessible to the host processor in response to a determination that the firmware for booting the host processor is digitally signed and authorized to be loaded on the host processor, the memory store accessible to the host processor is different from the secure memory store accessible to the security processor; wherein the firmware will not load or launch the software image if the signature key associated with the software image fails validation, and wherein validation failure is a result of at least one of an expired certificate, a missing certificate or a revoked certificate.