So it just boils down to TPM-protected encrypted storage? That obviously works (because it&#x27;s how a bunch of devices work today), but it&#x27;s a lot less exciting... if you can set up a full TPM stack for sealed storage (which we don&#x27;t have on consumer linux today :( ) then I don&#x27;t see what attacks this &quot;stateless laptop&quot; defends you against that the TPM doesn&#x27;t already handle.