There are secure enclaves that can proof to outside observers which code is running in a machine.

Pretty mind blowing!

Still relies on some trust in the hardware producer at the factory time.