The plan is calculated right into a PCR from the Confidential VM's vTPM (which happens to be matched in The true secret launch coverage around the KMS with the expected coverage hash to the deployment) and enforced by https://brontexyno470974.blogdun.com/31140536/the-best-side-of-confidential-ai-nvidia