My trusted root certificates are below. As an exercise, I want to be sure that a MITM is not changing the list. So, can I somehow get this list signed?
In my opinion, the list could be signed by my laptop's TPM using a key signed by my laptop's manufacturer, HP. The final verification process is then:
- copy these 3 items (the list, TPM's signature, and HP's signature) to a trusted computer
- trusted computer checks the signatures to show that their keys work
- trusted computer goes online to verify that the public key used for HP is trustable (ideally, trusted computer builds a certificate chain from HP to its own root, but my Googling HP or phoning HP is probably sufficient)
I'm guessing TPMs do not have this capability today, so here's a broader question: What would you do if you suspected that your TPM has an additional "evil root certificate" which always gets hidden by an "evil fake certmgr app"?