You can use remote attestation, as provided by a TPM, using SRTM.
Ensuring a TPM is genuine
Despite what @tylerl says, you do not have to trust your own signing key for a TPM to provide attestation. A genuine TPM will use an Endorsement Key, or EK, which is a key burnt into the TPM at manufacture time, with the corresponding private key never being released to the public (similar to how PKI for the web works). The only way a fake TPM could be presented (such as being emulated in software) would be if the Endorsement Key is not secret. If your datacenter has a stolen EK, you have a lot more to worry about. A TPM will not protect you from such an adversary anymore than HTTPS will protect you from a rogue CA.
A TPM provides a feature called measured boot, the specifics of which can be found all over this website. The gist of it is that a secure, read-only component of your BIOS, called the CRTM, initiates a chain reaction where different components of your system are hashed and sent to the TPM. Unless all the hashes match a known-good state, the TPM will stay locked, or sealed. The only way it can ever be unsealed is when the system is in a known state. The exact data which it seals is arbitrary. It can be used to seal, for example, encryption keys, so the system can only be booted if the system has not been tampered with. It can also be used to store a secret value known only to you, such that malicious hardware cannot predict what this value is and present it to you. Only if you see it do you know that the TPM is both genuine and your system is in a sane state. This is the basis for Joanna Rutkowska's Anti-EvilMaid.
Integrity after TPM has done its job
The TPM's job ends once it boots your kernel. It ensures that all the rest of your system, from BIOS to option ROMs to bootloader to NVRAM has been measured, but after measuring the kernel, its job is done. The kernel has been measured, but the rest of the system is not. When you get to this point, the kernel must provide some sort of measurement. One feature Linux has is the Integrity Measurement Architecture, or IMA. IMA works by keeping a hash of all files on the system in an extended attribute. These hashes are compared verified using a master root hash which is stored in the TPM. The kernel will refuse to read any files with no hashes or who's hashes cannot be verified as legitimate. At this point, you have successfully undergone measured boot and are now in a trusted running environment.
- Measured boot does not prevent against some types of hardware attacks, such as DMA attacks. Preventing those is sometimes possible (e.g. with DMAR), but out of scope here.
- If your adversary is powerful enough to get their hands on the DK, they can create a fake TPM in software and you won't know the difference.
- In order to get a valid readout from the TPM, the system must be, at least initially, not compromised, or you must check the reported hashes against known-good values.
- Some BIOSes may have an incorrect implementation of measured boot. For example, the CRTM may reside in writable flash storage, and a TPM relies on the CRTM being read-only.
- An well-resourced adversary may be able to decap the TPM and read the contents inside with an electron microscope. This is very difficult, but physically possible.
- Older versions of TPM (1.1) were vulnerable to platform reset attacks. You should use a newer TPM (2.0 or at least 1.2) to avoid this. Alternatively, Intel's integrated iTPM may work for you.