Is modelwrap running on arbitrary clients? I'm not following the whole post, but how are you able to maintain confidence in client-owned hardware/disks following the secure model the method seems to depdend on?

The disk isn’t client owned, but anyone can run modelwrap on any device and reproduce the root measurement that is being attested against.