attezt: device attestation, PKCS11 and ACME
attezt brings the IETF device-attest-01 ACME challenge and PKCS#11 attestation to Linux.
IETF is standardizing the device-attest-01 ACME challenge so organizations can provision device-bound certificates whose signing keys cannot be extracted from the intended machine. The Linux project attezt supplies an ACME client, an attestation server with simple inventory support, and a PKCS#11 agent. A 2026 All Systems Go talk explains the challenge and how the pieces support mTLS with strong device identity.
33