[whiatp]

Yeah, if the CPU has a an embedded TPM that would be way better than the external ones. I'll admit that my experience comes from somewhat dated hardware.

The point I was making was about registering new EKs/certs into your set of trusted servers. While you can tell the TPMs apart from each other, knowing the EK/cert belongs to your hardware's TPM vs someone else's is the tricky part.

[mike_hearn]

TPMs were moved into the Northbridge (I think) many years ago, at least on Intel systems.

PC hardware still isn't tamper resistant though. Memory may be encrypted but its contents can be tampered with in other ways. Only SGX made a serious attempt to be tamper resistant, although Intel eventually sacrificed that to boost performance.