TEE attestation.

Shared verify_certificate_chain() with pinned vendor root CAs (Intel, AMD, AWS, NVIDIA). Validity period and key usage extensions are enforced.

verify_ecdsa_p256_raw_pubkey   Intel TDX QE over Quote[0..632]
verify_ecdsa_p384_raw_pubkey   AWS Nitro COSE_Sign1 ES384
extract_ec_point_from_spki     shared SPKI utility

curl -X POST https://api.tenzro.xyz/verify/tee-attestation   -H "content-type: application/json"   -d '{"vendor":"intel-tdx","quote":"..."}'

bind_external_attestation_result binds an externally-verified AttestationResult (e.g. from IntelTiberClient::verify_quote) to a TeeZkProof by enforcing vendor and measurement parity.

Single-GPU attestation evidence is collected through NVML (libnvidia-ml.so.1, shipped with every NVIDIA driver): nvmlDeviceGetConfComputeGpuAttestationReport and nvmlDeviceGetConfComputeGpuCertificate.

libnvidia-nscq is a different library for a different job — NVSwitch fabric attestation on NVLink-connected multi-GPU systems. It is not required for single-GPU evidence.

Collection fails closed on: CC disabled, DevTools mode (a valid signature over a machine that is not enforcing confidentiality), a non-production environment, no CC-capable GPU, or no CPU confidential VM to anchor to.

An EnclaveRequest carrying include_attestation gets a live report whose user_data is SHA-256("tenzro/tee/enclave-response" ‖ len-prefixed(request_id, operation, data)).

Because user_data is covered by the hardware signature, a relying party that verifies the report and recomputes the binding learns that this exact output came from an enclave with that exact measurement — rather than merely that some enclave existed. Length prefixing stops a response being lifted from one request and presented as the answer to another.

The call fails rather than returning attestation: None when evidence was requested and the hardware cannot produce it.