> For example, at my company we validate that laptops follow our corporate policy, which includes a default-deny app installation policy. Presumably (hopefully

> For example, at my company we validate that laptops follow our corporate policy, which includes a default-deny app installation policy. Presumably (hopefully) these are corporate-owned devices, with a policy like that. Remote attestation is fine if it's controlled by the device's owner, and you can certainly run free software on such a device, if that particular build of the software has been "blessed" by the corporation. However, the user doesn't get the freedoms which are supposed to come with free software; in particular, they can't build and run a modified version without first obtaining someone else's approval. At the very least it suggests a certain lack of respect for your employees to lock down the tools they are required to use for their job to this extent.