More so that attestation requires the model to be running on secure hardware, which is hard to do across all models that a company like Anthropic serves.

In part because many of the accelerators they use may not support attestation, and even with ones that do, such as NVIDIA Blackwell, support is restricted to a single node (8 GPUs). Vera Rubin supports rack-scale encryption, but that is not broadly deployed yet and will not be the only accelerator they use to serve inference.