Comment by gmfawcett

Not mutually exclusive, as long as you have a trusted mechanism for establishing mutual trust between hardware roots. How do you achieve this when one of the roots is a distributed cloud service, provided by a third party?