@GrapheneOS -- I am not surprised that they are going for hardware certificates since the CPU chiphering / randomness tampering is going to fade away soon:

https://github.com/robang74/uchaosys/blob/v071/docs/linux-kernel-internals-hacking.md#can-we-do-even-better

...and yes, I am again me: the one behind the Sailfish OS refactoring attempt then presented as RedFish OS at SFSCONF 2023.

***