That depends on how the attestation is done. If done correctly, TPMs on every computer would be preloaded with signing keys (probably microsoft). The web browe

That depends on how the attestation is done. If done correctly, TPMs on every computer would be preloaded with signing keys (probably microsoft). The web browerser would then ask the TPM to sign the Platform Configuration Registers, which are a hash of a challenge nonce, the system firmware/kernel/configuration/etc. This signature is then sent (along with a description of the system configuration) to an external attester. This external attester validates that: A) the claimed configuration is "secure" (trusted kernel, bootloader, browser, etc) and B) The TPM's signature attests to the configuration. The validator then generates its own signed message that can be sent to the server. In practice, I think this is logistically unworkable in todays computing environment. But with enough big players pushing for it, I don't see anything fundamentally impossible.