A system, comprising: a virtualization host of a computing service of a provider network, wherein the virtualization host comprises a first offload card, wherein the first offload card includes one or more components of a virtualization manager; wherein the one or more components are configured to: initiate a first phase of a multi-phase boot operation of the virtualization manager, wherein the first phase comprises using a first key pair to validate one or more firmware programs, wherein a particular key of the first key pair is stored in a tamper-resistant location; in response to determining that the first phase has completed successfully, initiate a second phase of the multi-phase boot operation, wherein the second phase comprises (a) measuring the one or more firmware programs using a security module and storing the measurements at the security module and (b) launching a first version of a virtualization coordinator at the first offload card; obtain, utilizing another particular key obtained from the security module by the first version of the virtualization coordinator, a different version of the virtualization coordinator, wherein the other particular key is obtained from the security module in response to the security module using the stored measurements to determine that the second phase of the multi-phase boot operation completed successfully; launch the different version of the virtualization coordinator at the first offload card; and initialize one or more other components of the virtualization manager to complete the multi-phase boot operation, including at least one component which runs at a processor which is not installed on the first offload card. a virtualization host of a computing service of a provider network, wherein the virtualization host comprises a first offload card, wherein the first offload card includes one or more components of a virtualization manager; wherein the one or more components are configured to: initiate a first phase of a multi-phase boot operation of the virtualization manager, wherein the first phase comprises using a first key pair to validate one or more firmware programs, wherein a particular key of the first key pair is stored in a tamper-resistant location; in response to determining that the first phase has completed successfully, initiate a second phase of the multi-phase boot operation, wherein the second phase comprises (a) measuring the one or more firmware programs using a security module and storing the measurements at the security module and (b) launching a first version of a virtualization coordinator at the first offload card; obtain, utilizing another particular key obtained from the security module by the first version of the virtualization coordinator, a different version of the virtualization coordinator, wherein the other particular key is obtained from the security module in response to the security module using the stored measurements to determine that the second phase of the multi-phase boot operation completed successfully; launch the different version of the virtualization coordinator at the first offload card; and initialize one or more other components of the virtualization manager to complete the multi-phase boot operation, including at least one component which runs at a processor which is not installed on the first offload card. initiate a first phase of a multi-phase boot operation of the virtualization manager, wherein the first phase comprises using a first key pair to validate one or more firmware programs, wherein a particular key of the first key pair is stored in a tamper-resistant location; in response to determining that the first phase has completed successfully, initiate a second phase of the multi-phase boot operation, wherein the second phase comprises (a) measuring the one or more firmware programs using a security module and storing the measurements at the security module and (b) launching a first version of a virtualization coordinator at the first offload card; obtain, utilizing another particular key obtained from the security module by the first version of the virtualization coordinator, a different version of the virtualization coordinator, wherein the other particular key is obtained from the security module in response to the security module using the stored measurements to determine that the second phase of the multi-phase boot operation completed successfully; launch the different version of the virtualization coordinator at the first offload card; and initialize one or more other components of the virtualization manager to complete the multi-phase boot operation, including at least one component which runs at a processor which is not installed on the first offload card.