The problem is (I think) you can't get a TPM to tell Google you're running on an unmodified phone (barring hardware mods or TPM exploits) if you have discrepancies from the unmodified phone visible in the CPU's RAM or flash.