Not explicitly; they're a black box with a stated security model where you trust the hypervisor (vs SEV-SNP where you can get some guarantees against it), and a

Not explicitly; they're a black box with a stated security model where you trust the hypervisor (vs SEV-SNP where you can get some guarantees against it), and attestation in Nitro is built around PCRs rather than the SEV-SNP launch measurement system which is built around VM state.