> Security critical devices, like TPMs and USB authentication fobs, are actually multiprogramming environments running applications written by different people.

> Security critical devices, like TPMs and USB authentication fobs, are actually multiprogramming environments running applications written by different people. Eh, that doesn't sound like the design of a security-critical device to me. Many a "secure execution environment" has failed to deliver its security guarantees after some third-party clown was given access to run their DRM module or whatever, and introduced vulnerabilities while doing so. Devices that are serious about security tell the third party clowns to get their own chip. Although they may use a secure operating system as an extra layer of security, if it promises that.