You're absolutely right that almost all organizations have lower-hanging fruit to worry about than remote attestation, reproducible builds and transparency logg

You're absolutely right that almost all organizations have lower-hanging fruit to worry about than remote attestation, reproducible builds and transparency logging with distributed trust assumptions. Nor do they spend three years designing said transparency log. Nor do they care about their USB authenticators being open-source hardware that uses a measured boot KDF instead of the verified boot approach. Nor do they design those devices using open-source tooling (Kicad, Yosys) or spend time and money reversing the NVCM programming and locking feature so they can lock their FPGAs using open-source tooling. But my companies do. We endeavour to advance the state-of-the-art in trustworthy computing, similarly to how my first company (Mullvad VPN) advances the state-of-the-art of what a privacy-focused VPN service should do. :)