Yes. I've described some of the flexibility characteristics elsewhere in this thread, but here's how you could do it: 1. The ROM stage measures the first mutab

Yes. I've described some of the flexibility characteristics elsewhere in this thread, but here's how you could do it: 1. The ROM stage measures the first mutable application stage A1, and makes the Compound Device Identifier (CDI) available to A1. CDI=Hash(UDS, Hash(A1), USS). 2. A1 creates a key pair for itself using CDI. 3. A1 measures A2 and creates a key pair for A2. 4. A1 signs A2's public key. This is the attestation. 5. A1 scrubs CDI and its private key from memory while ensuring that the attestation as well as A2's key pair is available to A2. Note that the TKey only supports two-stage boot chains at the moment. A1's key pair could also be signed by the vendor before shipping. We do it like this: https://github.com/tillitis/tkey-verification https://github.com/tillitis/tkey-verification