SigStore

Privacy-Preserving Intelligence — Steve Korshakov, Bee (acq. Amazon)

Jul 20, 2026 · 15:53

Steve Korshakov, founder of Bee (acquired by Amazon), explains how his company built the 'most sensitive capture device on the market' with a guarantee that no one—not even Amazon—can read user data. Bee records everything a user says, generating about 10 million tokens per year, and within a week learns virtually everything about the person. To protect data, the encryption key never leaves the user's phone; the phone runs an attestation pipeline checking workloads against a public transparency log (Sigstore) before sharing the key with backends running in confidential compute. Keys in memory expire after seven days, and a two-tier signing system ensures no insider can ship code unnoticed: a separate Amazon privacy team holds signing keys hardcoded into apps. The entire system is only about 20,000 lines of memory-safe code, most of it verifying attestation, with no homegrown cryptography. Korshakov also discusses the challenges of moving from startup to Amazon, and his view on taming AI agents: sandboxing and not giving them the ability to cause harm.

The Unofficial Guide to Apple’s Private Cloud Compute - Jmo, CONFSEC

Jul 30, 2025 · 20:36

Jonathan Mortensen explains Apple's Private Cloud Compute (PCC), a paradigm shift in confidential computing that delivers cryptographically provable privacy for AI inference on remote servers. He details Apple's five requirements—stateless computation, enforceable guarantees, non-targetability, no privileged runtime access, and verifiable transparency—and six technical components, including oblivious HTTP, blind signatures, secure enclave, remote attestation, transparency logs, and secure boot. The talk highlights how remote attestation allows an iPhone to verify server software and tie encryption to that verified state, while the transparency log enables public auditing of all deployed binaries. Mortensen notes trade-offs: complete trust in Apple's supply chain, higher latency and compute costs, and no support for custom models or third-party developers. He points to alternative tools like TPMs, SigStore, and confidential VMs for non-Apple environments, and concludes that Apple's approach is being adopted by Azure AI and Meta.