HW RoT prevents you from being able to replace OS binaries with compromised versions. How are you going to prove your external boot drive isn't compromised with

HW RoT prevents you from being able to replace OS binaries with compromised versions. How are you going to prove your external boot drive isn't compromised without HW RoT? HW RoT reduces the attack surface available and gives a more secure baseline but sure it can be compromised. But an external drive is the Wild West. This is the reason black sites don't allow support people to bring their own tools onsite as you have to assume they're compromised.