Every certificate proves its context.

On every CSR the device produces a TPM2_Quote over the PCRs you have designated (0/1/2/3/4/7 by default, plus PCR10 if you use Linux IMA). The verifier issues a challenge nonce, checks the AK signature, replays the event log if configured, and compares each PCR to your golden set. Any mismatch — a rolled bootloader, disabled Secure Boot, unknown firmware — fails the check and the CA refuses to sign.

Attestation policies are per device type. Fleets with embedded secure elements (Microchip ATECC, NXP SE050) can enrol via IEEE 802.1AR IDevID without TPM2_Quote — you lose PCR verification but keep hardware-rooted identity and non-exportable keys. TigerTrust returns structured failure codes so you can gradually raise the bar as the fleet refreshes to TPM-equipped hardware.

PCR values are captured as a versioned allow-list per device type. When you sign a new firmware image, you register its expected PCR values before rollout; devices reporting the new set are accepted alongside the old. Once the fleet has migrated you retire the old entry. This gives you a clean two-window model that never leaves a device stuck between firmware states.

Yes. Factory-line enrolment uses a local TigerTrust Collector that runs disconnected from your production cloud. Devices enrol from IDevID to LDevID at the line, sync happens on batch export. This pattern is deployed in semiconductor and automotive Tier-1 plants where the internet cannot reach the assembly floor.

PKI Core replicas scale horizontally. In production we have measured over 1 million certificates per hour on a modest 8-node cluster with an HSM signer pool. The bottleneck is normally the HSM sign rate — TigerTrust queues requests with backpressure so bursts never drop.