[zb3]

On-device doesn't have to mean on "your" device - they might refer to smartphones with remote attestation (like AVF pKVM) which of course are not really controlled by you..