zlacker

> absent a full chain-of-trust from boot, which I believe Android/iOS do provide, and possibly the proprietary desktop environments can provide

Exactly, absent all platforms except OSS operating systems like Linux.

Windows 11, with its required hardware TPM, can absolutely do this. So can modern macOS.