Accessing the tpm doesn't mean what you think it means. You can't by design get the key out of the tpm nor necessarily control which keys are trusted by local software nor remote machines.
Control of what software is allowed to run is ultimately control over everything else because one kind of control gives you every other variety. The fact that you can disable secure boot or control which keys are trusted is a nicety that could be withdrawn next year along with your ability to run Linux.
Your vendor approved software can then implement any sort of restrictions it pleases and remotely attest to the efficacy of such restrictions.
Yes sir mr Amazon sir user id running trusted windows 11 and can't save or share this video as per your contract with Disney nor are they allowed to view any known pirate sites or sites that look like pirate sites according to our heuristics.
Alternatively. Please upgrade to a trusted windows 11 machine to view this content.
I know this... I've even repeatedly stated as such in this thread.
The rest of your post is just a silly hypothetical and frankly linking gnu is just discrediting.
The last sentence is particularly disappointing. The article's analysis is correct and not particularly complicated it stands on its own regardless of whatever bias you possess.
> allowing third parties a say in what software is run is literally the entire point of remote attestation
No it isn't.
We're clearly of two very different minds, there's no way we're finding common ground on this, and I've already done the work of explaining to many people what TPM technology is, so I feel like I've done my part.
[1]https://superuser.com/questions/1024111/adding-keys-to-secur...
???
And how is HP fucking their eufi up a Microsoft problem?
My claim was that there where computers where Linux only ran with Microsofts signature. I listed two systems (HP/Surface) where this is the case. Mainly because finding more is a pain, with support requests more likely to go off to nowhere instead of outright showing that no support for it exists.
One might make the case that Microsoft claimed it would require the ability to add alternative keys and conveniently failed to enforce that claim. If the goal was to blame Microsoft instead of just showing that Secure Boot can be easily used to lock users into one top down approved system.
There is absolutely at least some money to be made locking down machines and corporate America would sell our kidney's for a quarter if they could get away with it.
There would likely have been lawsuits against Microsoft if they had taken further steps on that road but that doesn't mean they won't be interested in boiling us all slowly now or in the future.
Without it how do you keep someone from running whatever they please and lying to the machine on the other side of the connection?
I mean sure, if Microsoft decided that it wanted to do all of the things you said, and could convince all of the OEMs to help, and a bunch of services and ISPs or whatever, yes, that would suck. It's a totally fabricated hypothetical that would never play out, but sure.