Secure bootstrap is not enough: shoring up the trusted computing base