SPDM and DICE
- SPDM (Security Protocol and Data Model): DMTF. What it does: Lets a device prove its identity and firmware state to another component using certificates.
- DICE (Device Identifier Composition Engine): Trusted Computing Group. What it does: Builds a hardware-rooted device identity from the device's firmware layers.
Both depend on certificates issued by a trusted CA. A private PKI-as-a-Service hierarchy can issue these device identity certificates, keeping the root key protected in the EC datacenter HSM.