1. A device comprising: a processor; and a computer-readable storage device including modules, the modules when executed by the processor, configure the device to perform a secure boot process based at least in part on receiving an update for software, the modules comprising: a cryptographic module configured to secure the device by: generating a sealing seed, based at least in part on a fuse-derived secret value of the device, by hashing a concatenation of the fuse-derived secret value of the device to a device sealing constant; generating a migration key based at least in part on the sealing seed and at least one software descriptor associated with a previous version of the software; generating a sealing key based at least in part on the sealing seed and at least one software descriptor associated with a new version of the software, wherein the sealing key is used to generate one or more encryption keys; and encrypting secrets of the software based on the generating sealing key.