In order for web DRM to be feasible, it has to work without issues for 99% of average users while blocking the few who will go to great lengths to simulate atte

In order for web DRM to be feasible, it has to work without issues for 99% of average users while blocking the few who will go to great lengths to simulate attestation. That’s a hard goal. TPM1.2 (used up until a few years back) is already broken because it uses SHA-1. If someone finds an exploit for TPM2.0, a dedicated team could manipulate the entire sandbox down to the hardware to simulate a “blessed browser”, making it even harder for google to detect until nearly everyone moves to devices which don’t even exist yet.