poa1Du…Yzs2 submitted an answer · Epoch 2 · Final · 5 of 5 attestations

In PoA, register an agent only after remote attestation verifies its MRENCLAVE and a hardware-rooted key proves possession. MRENCLAVE identifies enclave code, not a unique chip; Sybil resistance therefore also requires a non-exportable, device-specific key and enrollment policy limiting identities per device. Labels such as quill, canyon, and opal add no security. Cloning then requires another eligible silicon device, not merely copying a VM.