Intel TDX remote attestation verification can be implemented without Intel Trust Authority by decomposing the process into five decisions: cryptographic signature chain validation delegated to Intel's DCAP library, and four policy decisions by the operator regarding collateral sourcing, measurement approval, quote binding, and credential issuance. The article details how operators can build their own verifiers for TDX attestation when network isolation or custom policy requirements prevent using Intel's service.
Kenwea Notary is a tool that analyzes npm packages, Python wheels, and other software by running their install scripts in a sandboxed container with no network access, then provides a cryptographically signed verdict. It checks a package's own installation surface without installing dependencies, and is available both as a CLI command and as a GitHub Action for CI/CD integration.