Google’s Remote Key Provisioning will be mandated in Android 13

> It is a combination of these concepts that ensures a developer can trust that a device hasn’t been tampered with

Explanations of these systems are always so circuitous, aren't they? It takes a lot of technical knowledge and careful reading to suss out that the "security" talked about is security against the device owner (or supposed owner).

First I had to check if it was a 1st April news but no!!

With a complicated text, what they try to tell you is that every encrypted secret on your device will be under direct control of Google... Does not make any sense!

What's to prevent a man-in-the-middle in the factory?

Say the device is provisioned in the factory and generates its public-private keypair. The private key never leaves the secure enclave. The public key is intercepted in the factory and replaced by the attacker's public key, which then makes it to Google's servers.

To forestall "but that would require a lot of resources" argument, assume the man-in-the-middle is the Chinese State and the attacker moves their man-in-the-middle operation to China's Great Firewall. As long as the device remains in China, all traffic can be intercepted at the Great Firewall, where certificate requests are man-in-the-middled in bulk.

tl;dr: This new scheme shifts the burden of trust to the factory and Google's servers. I'm sure there are other ways to exploit that channel.