Correct, this is what they do. Google requires hardware manufacturers who want to use Play etc to get their stuff signed with their root certificate, which the

Correct, this is what they do. Google requires hardware manufacturers who want to use Play etc to get their stuff signed with their root certificate, which the TPM then verifies. See https://developer.android.com/training/articles/security-key-attestation https://developer.android.com/training/articles/security-key... In particular: """ If the root certificate doesn't contain the public key on this page, there are two likely reasons: [It is from an old version of Android, or] The other likely reason is that the device isn't a Google Play device. In that case, the device maker is free to create their own root and to make whatever claims they like about what the attestation means. Refer to the device maker's documentation. Note that as of this writing Google isn't aware of any device makers who have done this. """ In other words, to get into the Google attestation party you have to get your device Google Play certified. Obviously device manufacturers are strongly incentivised to do this. Edit: If this were to be applied to desktops as well, the obvious approach would be to partner with Microsoft and make use of their trust root, because Microsoft's keys are installed in ~every TPM.