Something that really bothers me about #WEI and similar things like PAT (assuming good faith of course, which for WEI I can't, because why would it exist if PAT is a better designed system) is that if these big corporations really wanted to crack the problem of verifying that a human is making a request in a way that doesn't threaten software freedom, they could!
In fact Cloudflare's proposal to use Webauthn for this was already much better. The key (pun totally intended) is separation of responsibilities. The part of the hardware that does the attestation must be physically incapable of making assertions about your boot state or software stack in general.
And any verification of software integrity? That's for the user, you must design the firmware in a way that can notify the user if anything is changed. This isn't too crazy with how complicated firmware already is on modern devices, and it already exists.
#ComputingFreedom #TrustedComputing #FOSS