PATTERN Cited by 4 sources

Attestation-gated key release

Pattern

A secret holder (HSM, KMS, or the client itself) releases key material — signing keys, decryption keys, session keys — only to a workload that presents a verified attestation whose measurement matches a policy. Access is granted on proof of what code is running, not on network location, API keys, host identity, or operator trust. If verification fails, nothing is released: the system fails closed.

Anchorage Digital's phrasing: "keep the computation away from the sensitive data and use attestation to bridge the gap." (Source: sources/2026-10-27-aws-how-anchorage-digital-and-turnkey-verify-code-with-aws-nitro-enclaves)

Ingredients

1. A TEE (or TPM-measured host) that produces hardware-rooted measurements.
2. A key holder that verifies the attestation chain and compares measurements to an allowlist / access policy.
3. A way to make the allowlist meaningful — concepts/reproducible-builds and/or a transparency ledger so measurements map to audited source.
4. Freshness (nonce) and binding of the released key to the attested instance (e.g. an attested public key in the document).

Variants seen

Instance	Key holder	Released secret	Attested property
Anchorage / systems/visualsign	HSM	key material for the enclave software	Nitro PCRs (reproducible build)
systems/confidential-federated-compute	RAFT-replicated KMS in TEEs	data decryption keys	workload measurement vs published policy
systems/whatsapp-private-processing	the client device	ephemeral session key (RA-TLS)	CVM binary digest vs transparency ledger
systems/geokey-manager	provisioning service	regional root keys	TPM hardware identity + location

Trade-offs

• Moves trust from operators to hardware vendors' attestation PKI and to whoever curates the measurement policy.
• Policy maintenance: without reproducible builds every release changes the measurement and the allowlist must be updated.
• Doesn't defend against TEE side channels or bugs in the attested code — attestation proves identity, not correctness.
• Enables organizational separation: the team writing the attested code needs no key access; the key team needs no domain knowledge — the attestation is the contract between them.

Seen in

• sources/2026-10-27-aws-how-anchorage-digital-and-turnkey-verify-code-with-aws-nitro-enclaves — canonical generalized statement ("attestation as an access credential"); HSM releases key material only after Nitro Enclave attestation verifies.
• sources/2026-10-02-google-toward-provably-private-learning-from-federated-data — KMS releases decryption keys only to attested workloads matching a published access policy.
• sources/2025-04-30-meta-building-private-processing-for-ai-tools-on-whatsapp — client releases the session key only after RA-TLS attestation checks against a third-party ledger.
• sources/2026-10-23-cloudflare-pq-geokey-manager — TPM attestation gates issuance of a scoped fetch token for regional root keys.

Related

• concepts/remote-attestation · concepts/trusted-execution-environment · concepts/confidential-computing
• concepts/reproducible-builds
• patterns/protocol-algorithm-negotiation — the RA-TLS session gating described on the attestation page.