A computer-implemented method, comprising: receiving an attestation request from a customer system to a main subsystem of a computing device, the computing device operating a customer virtual machine associated with the customer system; sending a request to a limited subsystem provided using trusted hardware physically connected to the computing device, the limited subsystem configured to perform administrative tasks for the customer virtual machine; at a first secure crypto-processor of the limited subsystem, receiving a first certificate issued by a certificate authority; and generating first credentials using the first certificate and a first endorsement key of the first secure crypto-processor, the first endorsement key being unexportable from the first secure crypto-processor; generating, at the first secure crypto-processor, a second certificate for authenticating the main subsystem; at a second secure crypto-processor of the main subsystem, receiving the second certificate and generating second credentials using the second certificate and a second endorsement key of the second secure crypto-processor, the second endorsement key being unexportable from the second secure crypto-processor; generating, by the first secure crypto-processor of the limited subsystem, a first signed measurement for the limited subsystem, the first signed measurement including identifying information for the limited subsystem and the first credentials; generating, by the second secure crypto-processor of the main subsystem, a second signed measurement for the host computing device, the second signed measurement including identifying information for the host computing device, state information for the customer virtual machine and the second credentials; and sending an attestation response to the customer system, the attestation response including a certificate chain for the first and second certificates, the first signed measurement with the first credentials and the second signed measurement with the second credentials. receiving an attestation request from a customer system to a main subsystem of a computing device, the computing device operating a customer virtual machine associated with the customer system; sending a request to a limited subsystem provided using trusted hardware physically connected to the computing device, the limited subsystem configured to perform administrative tasks for the customer virtual machine; at a first secure crypto-processor of the limited subsystem, receiving a first certificate issued by a certificate authority; and generating first credentials using the first certificate and a first endorsement key of the first secure crypto-processor, the first endorsement key being unexportable from the first secure crypto-processor; generating, at the first secure crypto-processor, a second certificate for authenticating the main subsystem; at a second secure crypto-processor of the main subsystem, receiving the second certificate and generating second credentials using the second certificate and a second endorsement key of the second secure crypto-processor, the second endorsement key being unexportable from the second secure crypto-processor; generating, by the first secure crypto-processor of the limited subsystem, a first signed measurement for the limited subsystem, the first signed measurement including identifying information for the limited subsystem and the first credentials; generating, by the second secure crypto-processor of the main subsystem, a second signed measurement for the host computing device, the second signed measurement including identifying information for the host computing device, state information for the customer virtual machine and the second credentials; and sending an attestation response to the customer system, the attestation response including a certificate chain for the first and second certificates, the first signed measurement with the first credentials and the second signed measurement with the second credentials.