Okay, but as far as I can tell, "trusted" can be defined however the attestor chooses, and one way could be "the user is really using Chrome, on Windows, and is

Okay, but as far as I can tell, "trusted" can be defined however the attestor chooses, and one way could be "the user is really using Chrome, on Windows, and isn't running any extensions or other applications that we don't like." Same way HDCP can tell an application whether the video is being played on a screen rather than a capture card. No trusted screen? No video for you. That's DRM.