edit: The paper doesn't actually say if Intel are signing the attestation report in the CPU, so perhaps that's why.