I don't think that's sufficient. We need devices that only allow software to run that has been signed by TPM-resident keys on the device. Updates are only attem

I don't think that's sufficient. We need devices that only allow software to run that has been signed by TPM-resident keys on the device. Updates are only attempted to be installed if the binary has been signed by multiple keys (by people in different jurisdictions) and then the device prompts the user to sign the update (which requires entering the TPM passphrase). Even if you managed to compromise all of the developers you couldn't run signed code on the device -- you'd need the user to install it. And for bonus brownie points we could have reproducible build checking (a-la certificate transparency) against the source repo, to see whether the binary is different to the official one. However, I think the threat model might have to be reconsidered (if all the developers are compromised, couldn't they upload a bad hash to the certificate transparency trail with a dummy version that only one user is given?). I might write a blog post about this actually, though I'd need better experts than myself in IMA (which is what you'd use on Linux for this) and other secure-boot work.