That point of remote attestation. If you have the hardware module signs all software and the processor, coupled with an unblockable secure mode that only runs

That point of remote attestation. If you have the hardware module signs all software and the processor, coupled with an unblockable secure mode that only runs if the TPM authorizes it, then you have created a secure zone in the processor of which only TPM-authorized software can run. This defeats (1) and (2), with (2) having the obvious exception of human-observable components being observable anyways. This does serve DRM nicely. They don't care if you put a camera in front of a monitor for the purposes of DRM. They coupled this with an OS and driver that is formally verified to eliminated security bugs.