(3) is by far the most important, but I can’t see how it will get attention from legislators or regulators.
Also, even if it happens, how could we ensure that service providers (say a bank) don’t start enforcing hardware based attestation?
We’d either need non-attested devices to be common enough for them not to bother blocking them (we are here now), or explicitly protect the right to software freedom. Maybe as part of a more general right-to-repair?
https://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm.git/commit/?h=bleeding-edge&id=e2605d4039a42a03000856b3229932455717b48b
FYI, I think the fix will make it into 6.8.