> It wouldn't nail down which piece of hardware was compromised, but it would help identify that hardware is compromised.

Do TCP timings and retransmissions count as difference in outputs?