A financial services firm is deploying new laptops that must prove their firmware and boot components have not been tampered with before they are granted access to sensitive internal resources. Security wants each device to cryptographically record the state of every boot-stage component and allow a remote server to verify that record before authorizing the connection. Which hardware-based capability BEST satisfies this requirement?