Security

Every chip maker we trust, named and frozen.

A trust anchoris the short list of chip manufacturers we're willing to believe. The guarantee: we can't silently start trusting a new certificate authority. The whole list is frozen into our software when it's built and re-checked every time the service starts. If even one entry were altered, the service refuses to boot. Nothing is fetched at runtime, and there are no surprise additions. The list comes from Microsoft's central distribution of chip-manufacturer certificates.

The manifest

Counts, live from the embedded anchors

Manufacturer trust anchors

40

Intermediates pinned

2,093

Manufacturers covered

6

Last refreshed from TrustedTpm.cab @ 2026-05-16. Integrity-gated by SHA-256 manifest at host startup.

Process

How the list stays current

A scripted quarterly refresh (tools/refresh-trust-anchors.ps1) downloads TrustedTpm.cab from go.microsoft.com/fwlink/?linkid=2097925, Authenticode-verifies the cab against Microsoft's signer, expands it, and copies per-vendor root + intermediate folders into our repo. The script regenerates MANIFEST.json with SHA-256 fingerprints per cert; an operator git-diffs, commits, and opens a PR. CI builds, embeds the files as resources in the assembly, and the deployed host fails closed on startup if the manifest doesn't match.

AMD

3 roots · 53 intermediates

3 root certificate(s) tracked. Run a build against the live manifest to render fingerprints here.

Infineon

3 roots · 140 intermediates

3 root certificate(s) tracked. Run a build against the live manifest to render fingerprints here.

Intel

4 roots · 54 intermediates

4 root certificate(s) tracked. Run a build against the live manifest to render fingerprints here.

Microsoft

1 root · 1,824 intermediates

1 root certificate(s) tracked. Run a build against the live manifest to render fingerprints here.

Nuvoton

17 roots · 4 intermediates

17 root certificate(s) tracked. Run a build against the live manifest to render fingerprints here.

STMicro

6 roots · 18 intermediates

6 root certificate(s) tracked. Run a build against the live manifest to render fingerprints here.

Cloud trust roots

Trusting a cloud provider's own signature

If you choose to allow cloud devices, we don't take their word for it. We verify the cloud provider's own signature on the device's identity, using a second short, pinned list of provider certificates. It's the same frozen-list guarantee, applied to the major clouds.

  • AWS Nitro Enclaves Root G1: lets us verify Amazon's own signature on an AWS device's identity.
  • DigiCert Global Root G2: the same, for Microsoft Azure.
  • 16 AWS per-region signing certificates: confirm exactly which EC2 instance a cloud proof came from.
  • Google's public signing keys: the same check, for Google Cloud.