attestation.app/about meint:

[The Auditor app] performs a pairing process between the device performing verification (Auditor) and the device being verified (Auditee) to implement a Trust On First Use (TOFU) model.

TOFU stiftet im Fall des NitroPhones ja nun erst mal kein Vertrauen...

github.com/GrapheneOS/Auditor/blob/17/app/src/main/java/app/attestation/auditor/AttestationProtocol.java#L119-L192 besagt u.a.:

The OS can use the persistent generated hardware-backed key for signing but cannot obtain the private key. The key isn't be usable if verified boot fails or the OS is downgraded and the keys are protected against replay attacks via the Replay Protected Memory Block. Devices launching with Android P or later can provide a StrongBox Keymaster to support storing the keys in a dedicated hardware security module to substantially reduce the attack surface for obtaining the keys. StrongBox is paired with the TEE and the TEE corroborates the validity of the keys and attestation. The Pixel 3 and 3 XL are the first devices with a StrongBox implementation via the Titan M security chip.

Verstehe ich das richtig, dass das Vertrauen in die erwähnte Auditor-App-Verifikation im Wesentlichen darauf basiert, dass

• a) die Nitrokey GmbH den Titan-M-Chip nicht manipuliert bzw. den darin hinterlegten private key nicht ausgelesen hat, und
• b) der Titan-M-Chip "sicher" ist, also keine Backdoors o.ä. enthält?