[0x696C6961]

Or just extract the certificate from the hardware you own.

[staticassertion]

That is presumably a very expensive endeavor. We already have hardware that attempts to mitigate this and while I think it's possible for the government it's certainly not trivial.

[lern_too_spel]

This is a "solved" problem. Vendors whose keys are extractable get their licenses revoked. The verifier checks the certificate against a CRL.