A method, according to one embodiment, includes receiving a request for a hypervisor to run a virtual machine, determining using a processor whether the virtual machine is authorized to run using a data structure having metadata about properties of the virtual machine, determining using a processor whether the hypervisor is authorized to run the virtual machine using a digital signature of the data structure, receiving a decryption key from a key authority when it is determined that the virtual machine is authorized to be run and it is determined that the hypervisor is authorized to run the virtual machine, unlocking and/or decrypting the virtual machine using the decryption key, and running the virtual machine on a computer system. Other systems, methods, and computer program products are described in additional embodiments.