Physical attacks on the trusted hardware are out of scope

The specification places the hardware root of trust and the TEE in the trusted computing base. It assumes they resist software attacks, notes that the attacker may have physical access, and leaves sophisticated physical attacks, such as bus probing and side-channel analysis, as a residual risk ¹. It says that future revisions may add requirements for physical tamper evidence ¹.