A security engineer is hardening a fleet of new corporate laptops that will store sensitive intellectual property. The requirement is to ensure that a compromised bootloader or malicious kernel driver injected before the OS loads cannot silently persist, and that a remote attestation server can verify each device's boot integrity before granting access to internal resources. Which combination of technologies best satisfies this requirement?