Fundamentally you dont. Or ive never seen an actual solution in practice. Physical hardware comes down to trusting the layer one/two domain and (usually) the ma

Fundamentally you dont. Or ive never seen an actual solution in practice. Physical hardware comes down to trusting the layer one/two domain and (usually) the mac address. With virts you trust your infrastructure to pass through some blob like a pre shared key. Which again is just punting on the actual problem. In either instance you might inject manual authn/authz by requiring a human in the process. Hypothetically the problem of boot strapping trust is solved by tpm. However thats predicated on functional hardware attestation. And thus the hypothetical bit.