The Cr-48 and Chrome OS: Google's vision of the net

The Cr-48's Integrity measurement is done without involving the TPM by using a device-mapper target. Boot-time trust in the kernel allows for efficient block level integrity checking which has different applications than linux-ima and avoids some of the performance bottlenecks along the way:

https://patchwork.kernel.org/patch/101750/

(The code has clearly changed since then and should be reposted soon.)