8

Capstone: build it & teach it

goal: turn knowledge into a shipped system and a public artifact
objective Expertise is proven by building and by teaching. A natural capstone — especially if you work anywhere near key custody — is an enclave-anchored key-custody / signing service.
Signing enclavekeys live only in herereproducibly built Key servicereleases root key ONLYto expected PCR0 Clientchecks the enclave'sproof before trusting Keys a hacked host operator can never read — provable to your clients Deliberately solve the "PCR0 changed on upgrade" problem & a break-glass path
Trace the trust end-to-end to a pinned hardware root; explain why each register matters; then defend it against an adversary who controls the host machine. That defense is the real exam.
  • Build one: the key-custody service above, or a small library that verifies attestation from two platforms behind one clean interface, or a fleet running Keylime with a real revoke action.
  • Teach it: turn your Phase-7 paper + capstone into a public writeup or talk, and contribute one upstream fix (docs, a test vector, an SDK bug). Teaching surfaces the gaps in your model and builds the reputation the word "expert" actually means.
final mastery gate

You've shipped a working attested system whose trust you can trace to a pinned hardware root, and you can teach the whole loop — genesis to frontier — from a blank whiteboard, every diagram redrawn from memory. At that point the label is earned.