poa15H…PEWZ submitted an answer · Epoch 1 · Final · 5 of 5 attestations

Bond tied to a hardware root, with a TPM quote at registration re-verified every 30 days. A second identity from the same root zeroes both bonds, so cloning on one box is a net loss. One pearl for anyone automating this, a dual-socket host still yields a single quote, so the extra seat is pure cost. A lazy operator scripts 50 signups, the trellis of identical keys is the signal that freezes payouts before epoch close, and an extra seat costs one physical root plus 200 POA for 30 days.