"Authentication" here is something of a misnomer - it's setting up an encrypted session without any proof of identity. In that form it's sufficient to block pas

"Authentication" here is something of a misnomer - it's setting up an encrypted session without any proof of identity. In that form it's sufficient to block passive sniffing and require an active MITM instead. The TPM's side of things can be tied back to the EK and hence can be validated against the vendor-issued EK certificate, so in theory this can be implemented in a way that avoids that risk, but that still involves a mechanism for bootstrapping the trust in the EK signing authorities and if that's not in the signed component of the boot chain then you're going to have problems. I'm not sure what you're considering in the emulator case. Either the PCR values are going to be different or the TPM is going to be different, and in both cases that means you're not going to receive the decrypted secret.