Yeah I was interested for the first few paragraphs, then all of a sudden I get hit with two "genuinely"s and a

> That’s the third property, and it’s the one that decides this.

and I gave up at that point.

That's right, I'm learning in public here. In RATS we prove a machine is sound by measuring it and appraising the evidence. But after attestation the usual thing is to hand the machine a short-lived identity saying it is attested, and when that machine then authenticates over mTLS to something like an HSM, the thing that gives that machine its identity is a private key in a file. That bothered me, and there is surprisingly little written about closing that gap in RATS specifically. What I want is to tie that key in the TPM to the evidence of the confidential VM itself, and let that be the identity the machine carries after attestation. They're just working notes, feel free to correct me if my thinking is wrong here.

Client TLS is rather unusable on the Internet by a typical random end user visiting a random public site, so that should at least keep the specific scenario you describe at bay.

[dead]