For something like TPM, IMO, using a memory safe architecture should be table stakes nowadays. I would go further: the design should be as simple as possible to

For something like TPM, IMO, using a memory safe architecture should be table stakes nowadays. I would go further: the design should be as simple as possible to achieve its requirements, and the implementation should be formally verified.