Why can't you fake remote attestation? I imagine it's a bit more involved than swapping a user agent but is there some magic mechanism that makes it impossible to spoof?
Maybe not impossible but my understanding is the TPM and the closed source nature of the system level code will make it difficult enough that 99% of users will not be able to do it, which is what industry wants. They're never worried about diehards and hermits. Those people will be confined to their caves & made irrelevant.