> Currently too much of the trust chain relies on untrustworthy components. This will always be true unless you build all the components yourself. And you don

> Currently too much of the trust chain relies on untrustworthy components. This will always be true unless you build all the components yourself. And you don't have time to build all the components yourself. Therefore this will always be true. With root of trust measurement you get to see that you're running code you've arbitrarily decided to trust. Everything else you could do would be mitigations (e.g., look for access patterns that imply compromise) or attempts to suss out vulnerable and/or backdoored components (e.g., reverse engineering and analysis). Not that one should not do those other things, but that root of trust measurement is still both, essential and insufficient. Remember: perfection is the enemy because it's unattainable. We can tilt at windmills, but that won't get us anywhere.