There’s a few components that are necessary to make it work:

1. The provider open sources the code running in the enclave and pins the measurement to a transparency log such as Sigstore

2. On each connection, the client SDK fetches the measurement of the code actually running (through a process known as remote attestation)

3. The client checks that the measurement that the provider claimed to be running exactly matches the one fetched at runtime.

We explain this more in a previous blog: https://tinfoil.sh/blog/2025-01-13-how-tinfoil-builds-trust