On-chip keys may be extractable

Tee and Happel argue that ping-based location protocols backed by keys stored on the chip can be compromised if an adversary with physical access extracts those keys ⁵. In this specification, the evidence chain rests on the hardware root of trust's signed quote, whose signing key must be protected by the hardware ¹.