As far as this #TrustedPlatformModule was concerned, you're the enemy. The "trust" in trusted computing is about *other people* being able to trust your *computer*, even if they don''t trust *you*.

So that TPM does all kinds of tricks. It can observe and produce a cryptographically signed manifest of your computer's entire boot-chain, meant to be an unforgeable certificate attesting to which kind of computer you were running and what software you were running on it.

8/

The second CPU would be a #TrustedPlatformModule, a brute-simple system-on-a-chip designed to be off-limits to modification, even by its owner (that is, you).

The #TPM would ship with a limited suite of simple programs it could run, each thoroughly audited for bugs, as well as secret cryptographic signing keys that you were not permitted to extract.

26/

At core, here's what they envision: inside your computer, they will nest *another* computer, one that is designed to run a very simple set of programs, none of which can be altered once it leaves the factory. This computer - either a whole separate chip called a "#TrustedPlatformModule" or a region of your main processor called a #SecureEnclave - can tally observations about your computer: which operating system, modules and programs it's running.

45/