Their measurement and TPM support is probably the best in the industry at the moment. Matthew Garrett worked for them on this, and effectively you can have comp

Their measurement and TPM support is probably the best in the industry at the moment. Matthew Garrett worked for them on this, and effectively you can have completely measured boot of a system and the containers running on it. With IMA this would allow you to have systems that cannot run binaries that are not signed (the kernel simply wouldn't allow it).