When a TPM provides a remote attestation, several components are involved:
- the TPM as a tamper-resistant device containing a root of trust;
- the TPM as a device to measure the software running on the main processor and produce an attestation;
- software to connect to the TPM and retrieve the attestation and transmit it (this software is merely relaying a signed attestation provided by the TPM, so it need not be trusted).
The third point is “easy” insofar as such software already exists, and could be ported to tablets if there was a use for it.
The first point is a blocker in the mobile device ecosystem, because phones and tablets tend towards having very few chips; an extra TPM chip is seen a as significant cost increase. While TCG has defined specifications for a MTM (a lightweight TPM for mobile devices), I don't think an MTM found in any smartphone for the general public. Microsoft is pushing for TPM in tablets, so MTM or TPM in mobile devices may become more widespread (e.g. the new Windows Phone 8 has a TPM).
Point 2 does not actually require a TPM as a physical device, but a system component providing a TPM-like interface and running outside the reach of the normal operating system. For example, the OS (e.g. Windows RT or Android) could run in a virtual machine, with the hypervisor providing a (virtual) TPM. There are two immediate hurdles with this approach:
- The Cortex-A15 is the first ARM core providing virtualization extensions. Devices with A-15-based processors are barely coming out now.
- While the hypervisor can store the root of trust outside the reach of the main operating system at runtime, it needs a place to store this root of trust — that can't be the main flash memory where the OS could overwrite it.
The first hurdle can be solved with TrustZone, which provides a kind of specialized hypervisor with just two OS partitions and is present on all ARM-based processors used in smartphones and tablets (and it's difficult as a user to know what if anything it's used for). The second hurdle requires more support in the processor, but there are processors deployed in existing devices (e.g. the Motorola Droid) that provide at least a small amount of non-volatile memory in the form of fuses (physicall write-once) that are only readable by the “trusted world” side of TrustZone and not by the main operating system. A TPM interface can be built on top of that, and TCG is working on it. This may well be the “firmware-based TPM” in the ARM-based Surface (which does not have a discrete TPM chip).
So, to summarize: there are pretty much no tablets with actual TPMs. But there are tablets with something that can implement the same security requirements (with a slightly lower level of confidence). You can't yet buy any tablet and expect to have remote attestation working on it, nor can you implement it yourself because you won't get access to the root of trust, but with the current hype around BYOD, more and more products should be coming out.