Zero-Trust Attestation

TEE
Verification

A valid hardware quote proves the TEE exists. End-to-end verification additionally proves freshness, the confidential channel, the measured workload, source provenance, and the request route where applicable.

46/89 Hardware + TCB verified
1/89 End-to-end verified
36 Evidence incomplete
29 Explicit failures
23 Unavailable
Observed channel modes 0 TEE-Terminated TLS 17 Attested E2EE 20 TEE-only Gateway
What do these channel modes mean?

How to read this run

Hardware verification is the first gate, not the final verdict.

46 checks validated their hardware quote and TCB policy. Only 1 also proved every applicable layer through workload identity, source provenance, and request routing. All 36 incomplete checks passed hardware and TCB verification in this run.

  1. 46/89 Hardware + TCB Vendor-rooted quote and configured hardware policy both passed.
  2. 40/88 Freshness Current evidence is bound to a verifier-owned challenge.
  3. 26/60 Confidential channel A TLS or application encryption key is bound to the attested environment.
  4. 12/89 Workload identity The measured runtime matches the expected workload configuration.
  5. 1/89 Source provenance The measured runtime is linked to signed source or release evidence.
  6. 0/88 Request route The request is cryptographically bound to the selected backend.

Each denominator includes only checks where that layer applies to the provider's claimed confidentiality model.

✓
End-to-end verifiedEvery applicable evidence gate passed.
◐
Evidence incompleteHardware passed, but a later gate is not proven. This is not an explicit attestation failure.
✗
Explicit failureA mismatch or policy rejection was observed. The hardware quote may still be valid.
!
UnavailableFresh evidence could not be fetched; this does not prove the provider is outside a TEE.
Last checked: Sep 12, 2026, 2:00 AM 🔔 Alerts RSS Verdict policy: All applicable evidence gates must pass for end-to-end verification. Detailed methodology

Chutes

12/14 hardware + TCB Alerts RSS
Explicit trust failures At least one check has an explicit mismatch or policy rejection; other evidence layers may still have passed.
0 end-to-end 12 incomplete 1 explicit failures 1 unavailable
Intel TDX Attested E2EE Operators: Chutes Coverage 14/14
Hardware 1 bad TCB policy 1 bad Freshness 2 warning Channel binding 2 warning Workload identity 14 warning Source provenance 14 warning Request route 14 warning Availability 1 warning
Hardware evidence failed 1 TCB policy failed 1 Workload identity not proven 13 Source provenance not proven 13
◐ Deepseek Ai/DeepSeek V3.2 TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 144089589937110b05b0e2b4bcbeab3c4aa540301f6ed45f4b9311d463bccf7521f7d5540cde2c4ba93f8cba85f64943c68a55a18f8809a8c479fbb44fbade13
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:nightly-2026031300-7f2b15c9e6e9
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:21a6fb1c-e085-468d-b057-25be69045246
chute:deepseek-ai/DeepSeek-V3.2-TEEinstance:21a6fb1c-e085-468d-b057-25be69045246certificate-present:truegpu-evidence-count:8revision:a7e62ac04ecb2c0a54d736dc46601c5606cf10a6lock-modules:trueexternal-egress:falsechutes-version:0.6.6image-id:d63d064c-4add-5213-b278-d3125c8078fdimage-status:built and pushedimage-chutes-version:0.6.6
◐ Deepseek Ai/DeepSeek V4 Flash 0731 TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 6198a386a6c2a50989087dc82c288f2c55e7b9286f8a315a5516b0146c6edca94d21734fcc3f6b52203aad9a284a437215ea96dbf8eed21d81633166e8a210b1
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:0.5.17
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:4217ac31-b6c2-4825-8b66-6c8585b62673
chute:deepseek-ai/DeepSeek-V4-Flash-0731-TEEinstance:4217ac31-b6c2-4825-8b66-6c8585b62673certificate-present:truegpu-evidence-count:8revision:7eb21d27aee405755da5251f4458e9fff87c047block-modules:trueexternal-egress:falsechutes-version:0.6.11.rc2image-id:bc160be2-ac9a-5e0b-b156-b9f6f4a43a85image-status:built and pushedimage-chutes-version:0.6.11.rc2
◐ Google/gemma 4 31B Turbo TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 77465b4c0f44603c1047b720d1e8b32474914a41a78208ed53c01173146ae399252e9628c6a9c1f48ab27da705105423c27003d4402b023e10b109078db41355
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:0.5.13-post1c
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:17b8f3d4-6524-43cd-9e49-428f8ed1161a
chute:google/gemma-4-31B-turbo-TEEinstance:17b8f3d4-6524-43cd-9e49-428f8ed1161acertificate-present:truegpu-evidence-count:1revision:4135a98a9b728a548947683219633b25682223aclock-modules:trueexternal-egress:falsechutes-version:0.6.11.rc2image-id:a3028618-6f8f-5afc-9a51-8eff25f2e5c8image-status:built and pushedimage-chutes-version:0.6.11.rc2
◐ Moonshotai/Kimi K2.6 TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 120f0de3e45e7b897553d206211a1308385db24398935f106506a0b55667d673b08aba7ccbedf05a56efe25731f9d90feaaace91dded64b5e19e0e1fdd3e5671
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/vllm:nightly-2026031400-03df6abfe49f
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:34949a73-673d-4b2d-8f31-8326bb1a7b40
chute:moonshotai/Kimi-K2.6-TEEinstance:34949a73-673d-4b2d-8f31-8326bb1a7b40certificate-present:truegpu-evidence-count:8revision:d9cb81bc88b9bd2dc89877599f23c614ded72b9clock-modules:trueexternal-egress:falsechutes-version:0.6.6image-id:5bbb13bc-c050-518d-bb55-79994b540ec2image-status:built and pushedimage-chutes-version:0.6.6
◐ Moonshotai/Kimi K3 TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 6ec42ec594c64122f0681db75d3d13ff68bf30ea58a7275509c4111f0272a3ed94c538af68642ed645e222d2e077ea7268a0d2e85552e3b96bfccd6328d7f368
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:0.5.16-k3a
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:a7191785-f9e3-4011-b69a-9f8ac5ca3afa
chute:moonshotai/Kimi-K3-TEEinstance:a7191785-f9e3-4011-b69a-9f8ac5ca3afacertificate-present:truegpu-evidence-count:8revision:301be1b88c89c0d3a763da6301352cb8fe399e90lock-modules:trueexternal-egress:falsechutes-version:0.6.11.rc2image-id:aa5068c9-72cf-5af6-9045-d7e52193e36fimage-status:built and pushedimage-chutes-version:0.6.11.rc2
◐ Nemotron 3 Nano Omni 30B TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 3b4234153b4898f7b1952b7ec816c2b6ae32ef992bc15022f5e1417b85f444b7f76757548e5b1d3d11427021384f734c6e14e8f83cdde6e2f75ebe4f28e0e1c7
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/vonkaiser/nemotronomni:0.2.1
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:d6462971-4680-4286-81e4-8ac82dab5945
chute:Nemotron-3-Nano-Omni-30B-TEEinstance:d6462971-4680-4286-81e4-8ac82dab5945certificate-present:truegpu-evidence-count:1revision:d15962741057ae3a07147df504060e9f0838224elock-modules:trueexternal-egress:truechutes-version:0.6.5image-id:e41a2e2f-9822-58e6-a330-3d5901115a99image-status:built and pushedimage-chutes-version:0.6.5
⚠ Qwen/Qwen3 235B A22B Thinking 2507 TEE (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
◐ Qwen/Qwen3 32B TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 5a803904ae70c2036e52dc4916239ed57509d1396006ecef5ca14f1dfc9399c65abac5164824bf677479245d3bde48f96af8ea3aad16ea8a97ef726a5bbb45f0
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:0.5.13-post1c
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:1828239b-a3b3-47ae-8283-a8a413e8e26c
chute:Qwen/Qwen3-32B-TEEinstance:1828239b-a3b3-47ae-8283-a8a413e8e26ccertificate-present:truegpu-evidence-count:1revision:aa55da1ecc13d006e8b8e4f54579b1ea8c3db2dflock-modules:trueexternal-egress:falsechutes-version:0.6.11.rc2image-id:a3028618-6f8f-5afc-9a51-8eff25f2e5c8image-status:built and pushedimage-chutes-version:0.6.11.rc2
◐ Qwen/Qwen3.5 397B A17B TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 5df5b3f1ad5bc1f03c47fa3400d3697c2ed8b2ff62bc5a515e7d0de0f17af7ae44a8df888a1a040ae04314cee9f765205d855d05894e9e721e1a8525ba0ba844
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:0.5.17-qwen38
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:304e4c55-a7e3-48f6-bffd-11bf75416b66
chute:Qwen/Qwen3.5-397B-A17B-TEEinstance:304e4c55-a7e3-48f6-bffd-11bf75416b66certificate-present:truegpu-evidence-count:8revision:9f1f3de9a3a48cfd340fd73ca98c02625b7afb3block-modules:trueexternal-egress:falsechutes-version:0.6.11.rc2image-id:b08f6a2d-1665-5a3e-a194-4b06fd22ba2aimage-status:built and pushedimage-chutes-version:0.6.11.rc2
◐ Qwen/Qwen3.6 27B TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data c945480b2ed2f237a7ece382fe3df785b3c8d0230939698395c39bdd0e56b329105f9c51fc1c699331619b0d67cc8ed4c644407fea21a1c7bb48b470f11ad265
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:0.5.17-qwen38
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:5bcf9816-7422-4cea-913c-ea44cba65225
chute:Qwen/Qwen3.6-27B-TEEinstance:5bcf9816-7422-4cea-913c-ea44cba65225certificate-present:truegpu-evidence-count:1revision:e89b16ebf1988b3d6befa7de50abc2d76f26eb09lock-modules:trueexternal-egress:falsechutes-version:0.6.11.rc2image-id:b08f6a2d-1665-5a3e-a194-4b06fd22ba2aimage-status:built and pushedimage-chutes-version:0.6.11.rc2
✗ Qwen/Qwen3.8 27B TEE (TEE) Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
◐ Unsloth/Mistral Nemo Instruct 2407 TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data b4b7ad05ee1b9f7bcb38b5454c194d0d2b900569e9797e0a6351ec2df0e50a698b6ba1333656224e85de57df2f253bbafb853ccf46b17116750c6de286cbd1cc
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:nightly-2026050600-9bf2c6dee5f7
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:96c7611c-f704-4489-a527-796ce744d506
chute:unsloth/Mistral-Nemo-Instruct-2407-TEEinstance:96c7611c-f704-4489-a527-796ce744d506certificate-present:truegpu-evidence-count:1revision:e9976040f42d8a5590ed58cefe973061b3f973b5lock-modules:trueexternal-egress:falsechutes-version:0.6.8image-id:e8a097de-bebd-5dfe-b69f-532a6c06a57eimage-status:built and pushedimage-chutes-version:0.6.8
◐ Zai Org/GLM 5.1 TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 28a43c8519d7f53901481ee623a825352325ffbcad4a4d08c81369df5ea30bf19c6da8972d89eec6fad044b6dfc12760ba9815559be13595361583318401d9d2
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:nightly-2026032100-6483b7da6ccd
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:d669dc47-7ca6-4d33-b814-83510c78e6af
chute:zai-org/GLM-5.1-TEEinstance:d669dc47-7ca6-4d33-b814-83510c78e6afcertificate-present:truegpu-evidence-count:8revision:f396cf805182f4ca10fa675e1a99815b3ca384dblock-modules:trueexternal-egress:falsechutes-version:0.6.6image-id:ae476f71-ed8f-562e-b1af-49d49c948d6fimage-status:built and pushedimage-chutes-version:0.6.6
◐ Zai Org/GLM 5.2 TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data d9f8ca526a3e9ca9678dc836c140717de3d93721fa6d470ac8aa6bfa35649e4013d7fe7dd18f4981285b3ed8e5d199e6521b7dc17c7a5186abca3e22b92b29e4
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:0.5.15-post1a
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:63c93af0-2abe-4a13-a6f0-5606d4dcf9a1
chute:zai-org/GLM-5.2-TEEinstance:63c93af0-2abe-4a13-a6f0-5606d4dcf9a1certificate-present:truegpu-evidence-count:8revision:aec724e8c7b8ee9db3b48c01c320f63f9cdaf8aalock-modules:trueexternal-egress:falsechutes-version:0.6.11.rc2image-id:e5589f58-64d3-51f6-8a3d-146b1cd77940image-status:built and pushedimage-chutes-version:0.6.11.rc2

Maple

1/1 hardware + TCB Alerts RSS
Incomplete evidence Hardware and TCB passed, but one or more later evidence gates are not proven.
0 end-to-end 1 incomplete 0 explicit failures 0 unavailable
Attested E2EE Operators: Maple Coverage 0/0
Hardware 1/1 good TCB policy 1/1 good Freshness 1/1 good Channel binding 1/1 good Workload identity 1 warning Source provenance 1 warning Request route 1 warning Availability 1/1 good
Workload identity not proven 1 Source provenance not proven 1 Request route not proven 1
◐ Maple Enclave (AWS Nitro) Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Check No public attestation endpoint

NanoGPT

19/28 hardware + TCB Alerts RSS
Explicit trust failures At least one check has an explicit mismatch or policy rejection; other evidence layers may still have passed.
0 end-to-end 19 incomplete 6 explicit failures 3 unavailable
Intel TDX TEE-only Gateway Operators: Tinfoil Coverage 27/27
Hardware 6 bad TCB policy 6 bad Freshness 11 warning Channel binding Not shown Workload identity 28 warning Source provenance 28 warning Request route 28 warning Availability 3 warning
Hardware evidence failed 6 TCB policy failed 6 Workload identity not proven 25 Source provenance not proven 25
◐ DeepSeek V3.2 (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000007f35fd2398a46af0ec7719a763cce99ccffe28ce41c24951a8f06814d6a69b4a
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 2bb0b77d9d214e7c509ca6b75ce63bfd1986a36c94e20855e20b7044e35d3e2e ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Route binding No request-bound receipt
⚠ DeepSeek V4 Flash (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
◐ Gemma 4 31B (TEE) Intel TDX TEE-only Gateway Details
Freshness not proven No verifier-owned challenge binding was exposed.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data c83d7da0883e7f3ae6d627755ce154f03ee1f2dbee47f755f776c268323386d06c99feec1cbda2bdb7e4d21c58603318a8b7c0960839451b3d1244e6d7575b2d
Signature ECDSA-P384 ✓
Enclave TLS Pin 2bb0b77d9d214e7c509ca6b75ce63bfd1986a36c94e20855e20b7044e35d3e2e ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Workload operator Tinfoil (inferred)
TEE platform Tinfoil (inferred)
Route binding No request-bound receipt
✗ GLM 5.1 (TEE) Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
◐ GPT-OSS 120B (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000599c99940e1e3060542cd8f6ec28529033ee0363d05b4a046f89a6c659e5ce6e
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 2bb0b77d9d214e7c509ca6b75ce63bfd1986a36c94e20855e20b7044e35d3e2e ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Route binding No request-bound receipt
◐ Kimi K2.6 (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b7900000000000000000000000077b30590f8f7dacac2d648ffb39184e34122d024d4350085a5ae6731cabb385a
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 2bb0b77d9d214e7c509ca6b75ce63bfd1986a36c94e20855e20b7044e35d3e2e ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Route binding No request-bound receipt
⚠ Llama 3.3 70B (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
✗ Qwen3.5 397B (TEE) Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
◐ TEE/gemma 4 26b A4b Uncensored (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000f0be43f5fed188498d32eca4115c8547eec23b445b57f243b8346a34305163f6
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 2bb0b77d9d214e7c509ca6b75ce63bfd1986a36c94e20855e20b7044e35d3e2e ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Route binding No request-bound receipt
◐ TEE/gemma 4 31b It (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000edcf8814e2119f54fc6765acf0ed0da4c754636217458807b145731c8bd9d119
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 2bb0b77d9d214e7c509ca6b75ce63bfd1986a36c94e20855e20b7044e35d3e2e ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Route binding No request-bound receipt
◐ TEE/gemma4 31b:thinking (TEE) Intel TDX TEE-only Gateway Details
Freshness not proven No verifier-owned challenge binding was exposed.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data ccf96b762f26f55d33b3b93ddf913ea6e8efec72aa6cda2b142f3d558af27d13829094cfef30eb36f86d3953fa0ae4b6a5de6468d2023a2fd9facc41c6324569
Signature ECDSA-P384 ✓
Enclave TLS Pin 2bb0b77d9d214e7c509ca6b75ce63bfd1986a36c94e20855e20b7044e35d3e2e ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Workload operator Tinfoil (inferred)
TEE platform Tinfoil (inferred)
Route binding No request-bound receipt
✗ TEE/glm 5.1 Thinking (TEE) Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
◐ TEE/glm 5.2 (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000006f7effd05265d875dd3a42e0d86b15d971cee9d9d341f9cbce007983e5798051
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 2bb0b77d9d214e7c509ca6b75ce63bfd1986a36c94e20855e20b7044e35d3e2e ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Route binding No request-bound receipt
◐ TEE/glm 5.2:thinking (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000003cfcd2999ff4ba11d446548d269898767e4c29aeeaceb2d79f872c15708b4cce
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 2bb0b77d9d214e7c509ca6b75ce63bfd1986a36c94e20855e20b7044e35d3e2e ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Route binding No request-bound receipt
◐ TEE/glm 5.3 (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000f7bd7b6d20f11b3c32ac85c64751e53d63c42ef9fdb23ce86a5dae3ebd21cfe4
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 2bb0b77d9d214e7c509ca6b75ce63bfd1986a36c94e20855e20b7044e35d3e2e ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Route binding No request-bound receipt
◐ TEE/glm 5.3 Flash (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000f8a487f1670e442a751e439ff25c432f093a3b94cd5680df0af70f5b19682be9
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 2bb0b77d9d214e7c509ca6b75ce63bfd1986a36c94e20855e20b7044e35d3e2e ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Route binding No request-bound receipt
◐ TEE/gpt Oss 20b (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000bcffc346c2b276ccba3a33a8df0261f23940714e7a936b0985d1bc4946f23d76
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 2bb0b77d9d214e7c509ca6b75ce63bfd1986a36c94e20855e20b7044e35d3e2e ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Route binding No request-bound receipt
◐ TEE/kimi K2.7 Code (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000c3e992c2a27137a63c87edfc928dd46caf025be8f7851d23ed6956292a7bab43
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 2bb0b77d9d214e7c509ca6b75ce63bfd1986a36c94e20855e20b7044e35d3e2e ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Route binding No request-bound receipt
✗ TEE/kimi K3 (TEE) Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
◐ TEE/muse Glimmer 30b (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000f549970b673659637b8b7183a3fa2957d52fbca09623fa687815c718c72e6897
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 2bb0b77d9d214e7c509ca6b75ce63bfd1986a36c94e20855e20b7044e35d3e2e ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Route binding No request-bound receipt
⚠ TEE/nemotron 3.5 Lightning (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
◐ TEE/qwen2.5 Vl 72b Instruct (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000009544bc268167ec32da28bd5481a076d65d46a271a73642693ec7de50c6857f10
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 2bb0b77d9d214e7c509ca6b75ce63bfd1986a36c94e20855e20b7044e35d3e2e ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Route binding No request-bound receipt
◐ TEE/qwen3 8b (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000004443d93f30808482a9c14fac6a2b161c791227ee1325d34028d57d3efebc214d
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 2bb0b77d9d214e7c509ca6b75ce63bfd1986a36c94e20855e20b7044e35d3e2e ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Route binding No request-bound receipt
✗ TEE/qwen3.5 27b (TEE) Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
✗ TEE/qwen3.6 27b (TEE) Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
◐ TEE/qwen3.6 35b A3b (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000d11bb9ac67198cba4792882c9208b5139402348a8b6303a8a761e63f19e855e3
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 2bb0b77d9d214e7c509ca6b75ce63bfd1986a36c94e20855e20b7044e35d3e2e ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Route binding No request-bound receipt
◐ TEE/qwen3.6 35b A3b Uncensored (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000003152fef9b43d495f48d50de43f73987002b1502cd5fa2c599912588641803164
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 2bb0b77d9d214e7c509ca6b75ce63bfd1986a36c94e20855e20b7044e35d3e2e ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Route binding No request-bound receipt
◐ TEE/qwen3.8 27b (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000dd090737fedca915a45a150e46c37516c153f3592c86abcce259250f985f3a7a
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 2bb0b77d9d214e7c509ca6b75ce63bfd1986a36c94e20855e20b7044e35d3e2e ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Route binding No request-bound receipt

NEAR AI

0/11 hardware + TCB Alerts RSS
Availability issue The verifier could not fetch fresh evidence for every check in this run.
0 end-to-end 0 incomplete 0 explicit failures 11 unavailable
Coverage 11/16
Hardware 11 warning TCB policy 11 warning Freshness 11 warning Channel binding 11 warning Workload identity 11 warning Source provenance 11 warning Request route 11 warning Availability 11 warning
Endpoint unavailable 11
⚠ Deepseek Ai/DeepSeek V4 Flash (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
⚠ DeepSeek V3.2 (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
⚠ Kimi K2.6 (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
⚠ Kimi K3 (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
⚠ Openai/privacy Filter (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
⚠ Qwen/qwen3 32b (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
⚠ Qwen/Qwen3.8 27B (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
⚠ Qwen3-VL 30B (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
⚠ Qwen3.5 397B (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
⚠ Qwen3.6 35B (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
⚠ Z Ai/glm 5.3 Flash (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint

PPQ.AI

3/6 hardware + TCB Alerts RSS
Incomplete evidence Hardware and TCB passed, but one or more later evidence gates are not proven.
0 end-to-end 3 incomplete 0 explicit failures 3 unavailable
AMD SEV-SNP Attested E2EE Operators: Tinfoil Coverage 6/6
Hardware 3 warning TCB policy 3 warning Freshness 6 warning Channel binding 3 warning Workload identity 6 warning Source provenance 6 warning Request route 6 warning Availability 3 warning
Freshness not proven 3 Workload identity not proven 3 Source provenance not proven 3 Request route not proven 3
◐ DeepSeek V4 Flash (TEE) AMD SEV-SNP Attested E2EE Details
Freshness not proven No verifier-owned challenge binding was exposed.
Quote AMD SEV-SNP (VCEK)
Policy 0x30000
Report Data 84cf87e1cf0793e8fe4089229569bfa25c2f05882888b06170a13ee2b03676e0d7927a7374f3c5e17ffcb43f3f5231daa4198a5ba5420de844483a9df94b0841
Signature ECDSA-P384 ✓
Registry digest Digest exists in registry ✓
Sigstore Bundle Crypto Verified ✓
Measurements Match ✓
Release v0.0.147
Sigstore Repo tinfoilsh/confidential-model-router
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
ghcr.io/tinfoilsh/confidential-model-router@sha256:b1d919f20ca5a2b2171834a11cb98c68e5e4203fec9383ca2c6dd30c877fbdff
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by PPQ.AI
Routed through Tinfoil (corroborated)
Workload operator Tinfoil (declared)
Route binding No request-bound receipt
E2EE Protocol hpke
Signing Key d7927a7374f3c5e17ffcb43f3f5231daa4198a5ba5420de844483a9df94b0841
⚠ Gemma 4 31B (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
◐ GLM 5.2 (TEE) AMD SEV-SNP Attested E2EE Details
Freshness not proven No verifier-owned challenge binding was exposed.
Quote AMD SEV-SNP (VCEK)
Policy 0x30000
Report Data 84cf87e1cf0793e8fe4089229569bfa25c2f05882888b06170a13ee2b03676e0d7927a7374f3c5e17ffcb43f3f5231daa4198a5ba5420de844483a9df94b0841
Signature ECDSA-P384 ✓
Registry digest Digest exists in registry ✓
Sigstore Bundle Crypto Verified ✓
Measurements Match ✓
Release v0.0.147
Sigstore Repo tinfoilsh/confidential-model-router
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
ghcr.io/tinfoilsh/confidential-model-router@sha256:b1d919f20ca5a2b2171834a11cb98c68e5e4203fec9383ca2c6dd30c877fbdff
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by PPQ.AI
Routed through Tinfoil (corroborated)
Workload operator Tinfoil (declared)
Route binding No request-bound receipt
E2EE Protocol hpke
Signing Key d7927a7374f3c5e17ffcb43f3f5231daa4198a5ba5420de844483a9df94b0841
⚠ GPT-OSS 120B (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
◐ Kimi K3 (TEE) AMD SEV-SNP Attested E2EE Details
Freshness not proven No verifier-owned challenge binding was exposed.
Quote AMD SEV-SNP (VCEK)
Policy 0x30000
Report Data 84cf87e1cf0793e8fe4089229569bfa25c2f05882888b06170a13ee2b03676e0d7927a7374f3c5e17ffcb43f3f5231daa4198a5ba5420de844483a9df94b0841
Signature ECDSA-P384 ✓
Registry digest Digest exists in registry ✓
Sigstore Bundle Crypto Verified ✓
Measurements Match ✓
Release v0.0.147
Sigstore Repo tinfoilsh/confidential-model-router
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
ghcr.io/tinfoilsh/confidential-model-router@sha256:b1d919f20ca5a2b2171834a11cb98c68e5e4203fec9383ca2c6dd30c877fbdff
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by PPQ.AI
Routed through Tinfoil (corroborated)
Workload operator Tinfoil (declared)
Route binding No request-bound receipt
E2EE Protocol hpke
Signing Key d7927a7374f3c5e17ffcb43f3f5231daa4198a5ba5420de844483a9df94b0841
⚠ Llama 3.3 70B (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint

Privatemode

0/10 hardware + TCB Alerts RSS
Explicit trust failures At least one check has an explicit mismatch or policy rejection; other evidence layers may still have passed.
0 end-to-end 0 incomplete 10 explicit failures 0 unavailable
Operators: Edgeless Systems Coverage 7/7
Hardware 10 bad TCB policy 10 bad Freshness 10 warning Channel binding 10 warning Workload identity 10/10 good Source provenance 10 warning Request route 10 warning Availability 10/10 good
Hardware evidence failed 10 TCB policy failed 10 Freshness not proven 10 Channel binding not proven 10
✗ Deepseek Ocr 2 Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
✗ Glm 5.2 Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
✗ Glm 5.3 Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
✗ Glm Latest Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
✗ Gpt Oss 120b Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
✗ Gpt Oss Latest Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
✗ Kimi K2.6 Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
✗ Qwen3 Embedding 4b Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
✗ Voxtral Mini 3b Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
✗ Whisper Large V3 Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint

Redpill

2/2 hardware + TCB Alerts RSS
Explicit trust failures At least one check has an explicit mismatch or policy rejection; other evidence layers may still have passed.
0 end-to-end 0 incomplete 2 explicit failures 0 unavailable
Intel TDX Coverage 2/2
Hardware 2/2 good TCB policy 2/2 good Freshness 2/2 good Channel binding 2/2 good Workload identity 2 bad Source provenance 2 warning Request route 2 warning Availability 2/2 good
Workload identity failed 2 Source provenance not proven 2 Request route not proven 2
✗ Gemma 4 26B (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000924e7a5e0d492c296bdaaeda6b19c49650f009d1eddf9aa099d53552af6d4e93
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin c68585e7dc00a55d3082a9c860cb916e1788c5daec51505e413d27ab94f7d4c7 ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Redpill
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
✗ Qwen3.6 35B (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000aaba49dfd578a86357337bb80c96110d1d6b004458eb2298f2cee7215acd1998
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin e52fdca52c039def33e51cd2b5eded43eae1949030e47866f5f09e90b6940a88 ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Redpill
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d

Tinfoil

1/5 hardware + TCB Alerts RSS
Availability issue The verifier could not fetch fresh evidence for every check in this run.
1 end-to-end 0 incomplete 0 explicit failures 4 unavailable
AMD SEV-SNP TEE-only Gateway Operators: Tinfoil Coverage 4/14
Hardware 4 warning TCB policy 4 warning Freshness 4 warning Channel binding 4 warning Workload identity 4 warning Source provenance 4 warning Request route 4 warning Availability 4 warning
Endpoint unavailable 4
⚠ Gemma 4 31B Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
⚠ GPT-OSS 120B Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
⚠ GPT-OSS Safeguard 120B Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
⚠ Llama 3.3 70B Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
✓ Router AMD SEV-SNP TEE-only Gateway Details
Verified All required verifier gates passed for this check.
Quote AMD SEV-SNP (VCEK)
Policy 0x30000
Report Data 84cf87e1cf0793e8fe4089229569bfa25c2f05882888b06170a13ee2b03676e0d7927a7374f3c5e17ffcb43f3f5231daa4198a5ba5420de844483a9df94b0841
Signature ECDSA-P384 ✓
Registry digest Digest exists in registry ✓
Sigstore Bundle Crypto Verified ✓
Measurements Match ✓
Release v0.0.147
Sigstore Repo tinfoilsh/confidential-model-router
Enclave TLS Pin 1c53d211618948cbdde5cf3d8e3c3fa70f78624e57f90190abe4ef804270ebcb ✗
Version v0.0.147
ghcr.io/tinfoilsh/confidential-model-router@sha256:b1d919f20ca5a2b2171834a11cb98c68e5e4203fec9383ca2c6dd30c877fbdff
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by Tinfoil
Routed through Tinfoil (verified)
Workload operator Tinfoil (verified)
TEE platform Tinfoil (verified)
Route binding No request-bound receipt

Venice.ai

8/12 hardware + TCB Alerts RSS
Explicit trust failures At least one check has an explicit mismatch or policy rejection; other evidence layers may still have passed.
0 end-to-end 1 incomplete 10 explicit failures 1 unavailable
Intel TDX Attested E2EE Operators: phala, Phala/dstack Coverage 12/12
Hardware 3 bad TCB policy 3 bad Freshness 4 warning Channel binding 4 warning Workload identity 7 bad Source provenance 12 warning Request route 12 warning Availability 1 warning
Hardware evidence failed 3 TCB policy failed 3 Source provenance not proven 11 Request route not proven 11
✗ DeepSeek V4 Flash (TEE) Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
✗ E2ee Kimi K3 P (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000807202ff23bfb1c959a9145e5d038f0fb60772ad7ec2de1660d48c111a2cd545
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin efcb39af5e8c6eca015a0080ee349e18b01c791aa39023fb9a0ba84523e0e33f ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Venice.ai
TEE platform phala (inferred)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
✗ Gemma 4 26B (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000e550610de8a84c2fdc1bb025c397ef78a97cdaeb6a1d7f918aa1152c142bba91
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin efcb39af5e8c6eca015a0080ee349e18b01c791aa39023fb9a0ba84523e0e33f ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Venice.ai
TEE platform phala (inferred)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
✗ GLM 5.2 (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b7900000000000000000000000070ac843d2cc9abf4cc155dcd96bacd68f83c583f5cec93f65d13d2a3551bfe9e
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin efcb39af5e8c6eca015a0080ee349e18b01c791aa39023fb9a0ba84523e0e33f ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Venice.ai
TEE platform phala (inferred)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
✗ GLM 5.3 (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000006da8581eaf83279f328cc6f7697ed0e0def83151f75ff23187db6f32c9f217c7
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin efcb39af5e8c6eca015a0080ee349e18b01c791aa39023fb9a0ba84523e0e33f ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Venice.ai
TEE platform phala (inferred)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
◐ GLM 5.3 Flash (TEE) Intel TDX Attested E2EE Details
Source provenance not proven Registry existence alone is not source provenance.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 3b753b4406613c5e70ae640508632b600424fa0c00000000000000000000000023ff590f3fcc5e269a716aa4bc9cb9d81d87fa8768fff3d67e23005c34abea9a
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Registry digest Digest exists in registry ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Last Deploy v0.0.409
Gateway TLS efcb39af5e8c6eca015a0080ee349e18b01c791aa39023fb9a0ba84523e0e33f (external termination)
App dstack-nvidia-0.5.11
Images 5 containers
otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:6e035c8fb99c1d31f41760d25af178683a658cca4afd73cd0d366fbb5bf884benearaidev/compose-manager-launcher@sha256:91fdff3cfa3543d72656b2368c7d8a0a83d95a0f1087378c897aa1537acdba56
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image a6eafc5f007f642d8ea90c7fa8881f1e6715720ccb531941a28218f4f26d7b02
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Venice.ai
TEE platform Phala/dstack (corroborated)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 0442d42e51842e50841e08b096b62cdaf52786c7ce0b04577bb476cef327d42d8db9cc9dd35c9738bf7769e2b33d51c0a2d9aa01e85da0507ddb4e875a2b5bdfd1
✗ GPT-OSS 120B (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000e4fb0479805be95a556bd12ba25883b1564ed1ff3def3b24394d00475f9d6d7b
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin efcb39af5e8c6eca015a0080ee349e18b01c791aa39023fb9a0ba84523e0e33f ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Venice.ai
TEE platform phala (inferred)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
⚠ Kimi K2.6 (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
✗ Qwen 2.5 7B (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000006043a311305662db2c2f6da946b54b7dc30d286d23912a43a2ec37ef8dfb5d5a
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin efcb39af5e8c6eca015a0080ee349e18b01c791aa39023fb9a0ba84523e0e33f ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Venice.ai
TEE platform phala (inferred)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
✗ Qwen3 35B (TEE) Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
✗ Qwen3-VL 30B (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000004967af10b6ed8c29669ab2095e6e856835c5ef3135c576f5d6ce4ef40e0b12f0
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin efcb39af5e8c6eca015a0080ee349e18b01c791aa39023fb9a0ba84523e0e33f ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Venice.ai
TEE platform phala (inferred)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
✗ Qwen3.8 27B (TEE) Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint

Shared Workload Operators

Current model checks point to the same operator or TEE platform. This does not imply a shared physical machine, and route evidence may not be request-bound.

Tinfoil NanoGPT · PPQ.AI · Tinfoil

Verification Methodology

Tinfoil Enclaves

Fetches .well-known/tinfoil-attestation from each enclave. The response contains a gzipped, base64-encoded hardware quote. For TDX enclaves, the quote is verified through Intel DCAP Quote Verification Library (dcap-qvl) using Intel PCS collateral (override via PCCS_URL if needed). For SNP enclaves, the report is verified against AMD KDS VCEK certificates with builtin ARK/ASK roots. TLS certificate SPKI fingerprints are compared to the attested report_data.

Venice.ai / Redpill / NEAR AI (dstack)

All three providers use the same dstack attestation format. Venice returns a direct attestation; Redpill and NEAR AI return a two-layer format (gateway + model attestations). In all cases, the raw intel_quote hex is parsed as a TDX quote and verified via dcap-qvl using Intel PCS collateral (or PCCS_URL override). The quote-bound tcb_info.app_compose hash is recomputed and compared to tcb_info.compose_hash; when compose-manager actions_hash evidence is present, that is recomputed too. Provider server_verification and verified fields are completely ignored.

NVIDIA GPU Attestation

Non-empty GPU evidence payloads are submitted to NVIDIA's current NRAS endpoint, which returns a signed JWT. The JWT signature is verified against NRAS's JWKS, the issuer is pinned to nras.attestation.nvidia.com, and the eat_nonce is checked against the request nonce. Empty or malformed provider evidence and mismatched provider nonces are rejected locally before any NRAS request.

Chutes / Maple / Privatemode / Other Providers

Chutes is checked by fetching a live TEE chute's evidence endpoint, verifying the Intel TDX quote with dcap-qvl, checking that report_data binds the verifier nonce plus the ML-KEM E2E public key, and verifying NVIDIA GPU evidence when present. Chutes checks stay partial unless the workload image is digest-pinned or equivalent signed provenance is exposed. Maple Nitro checks also stay partial until expected PCR/workload provenance is configured. Privatemode is checked with a pinned Contrast CLI: the Coordinator is remotely attested, the active manifest must match the CDN manifest hash, and digest-pinned images are extracted from the verified initdata before the local proxy model path is accepted. PPQ is not counted as verified from liveness alone.