I fear it is already too late, thanks to the phone duopoly and bulletproof secure boot environments. The EU can now make remote attestation mandatory by law.