I think they use industry standard techniques (trust anchroing, attestation, etc) but their implementation is not fully open.

I'm actually fine with that.