> and we also are exploring using TPM remote attestation I can already tell this is very likely not going to work fully, or even work for a sizeable chunk of L

> and we also are exploring using TPM remote attestation I can already tell this is very likely not going to work fully, or even work for a sizeable chunk of Linux installations out there. Many platforms don't have TPMs, or have TPMs from unknown CAs. Or firmware that you're not aware of. Or even worse, people might just be running a Linux distribution that you don't know about. Or a patched kernel. Or a bootloader that doesn't measure the next stage into TPM. Not to mention, even the most popular distributions allow you to do anything with root access, things that you just won't be able to measure, but that might allow people to cheat. TPMs really only make sense for _very_ controlled environments if you want to prevent hardware tampering at this level. The diversity of Linux distributions (and PCs in general) truly works against you here.