An apparatus comprising: a processor; and a memory, wherein the memory comprises instructions that, when executed, cause the processor to: establish a portion of the memory as a trusted execution environment, and execute a trusted third party application within the trusted execution environment, the trusted third party application to include: receiving logic to receive a signed public key and an identifier for a verifier from a user client attestation application executing on a client platform, the signed public key being signed with an identifiable platform attestation private key for the client platform, verifying logic to verify the signed public key, policy-determining logic to determine a policy of the verifier, policy-encoding logic to encode the policy into a trusted third party anonymous certificate for the signed public key, issuing logic to issue the trusted third party anonymous certificate without including identification information of the client platform, and sending logic to send the trusted third party anonymous certificate to the user client attestation application, wherein the policy-determining logic is to dynamically determine that the policy requires linking the trusted third party anonymous certificate to a second trusted third party anonymous certificate, the trusted third party application further comprises linking logic to link the trusted third party anonymous certificate to the second trusted third party anonymous certificate, and the linking specifically is: associating two or more certificates as being issued to the same platform. a processor; and a memory, wherein the memory comprises instructions that, when executed, cause the processor to: establish a portion of the memory as a trusted execution environment, and execute a trusted third party application within the trusted execution environment, the trusted third party application to include: receiving logic to receive a signed public key and an identifier for a verifier from a user client attestation application executing on a client platform, the signed public key being signed with an identifiable platform attestation private key for the client platform, verifying logic to verify the signed public key, policy-determining logic to determine a policy of the verifier, policy-encoding logic to encode the policy into a trusted third party anonymous certificate for the signed public key, issuing logic to issue the trusted third party anonymous certificate without including identification information of the client platform, and sending logic to send the trusted third party anonymous certificate to the user client attestation application, wherein the policy-determining logic is to dynamically determine that the policy requires linking the trusted third party anonymous certificate to a second trusted third party anonymous certificate, the trusted third party application further comprises linking logic to link the trusted third party anonymous certificate to the second trusted third party anonymous certificate, and the linking specifically is: associating two or more certificates as being issued to the same platform. establish a portion of the memory as a trusted execution environment, and execute a trusted third party application within the trusted execution environment, the trusted third party application to include: receiving logic to receive a signed public key and an identifier for a verifier from a user client attestation application executing on a client platform, the signed public key being signed with an identifiable platform attestation private key for the client platform, verifying logic to verify the signed public key, policy-determining logic to determine a policy of the verifier, policy-encoding logic to encode the policy into a trusted third party anonymous certificate for the signed public key, issuing logic to issue the trusted third party anonymous certificate without including identification information of the client platform, and sending logic to send the trusted third party anonymous certificate to the user client attestation application, receiving logic to receive a signed public key and an identifier for a verifier from a user client attestation application executing on a client platform, the signed public key being signed with an identifiable platform attestation private key for the client platform, verifying logic to verify the signed public key, policy-determining logic to determine a policy of the verifier, policy-encoding logic to encode the policy into a trusted third party anonymous certificate for the signed public key, issuing logic to issue the trusted third party anonymous certificate without including identification information of the client platform, and sending logic to send the trusted third party anonymous certificate to the user client attestation application, wherein the policy-determining logic is to dynamically determine that the policy requires linking the trusted third party anonymous certificate to a second trusted third party anonymous certificate, the trusted third party application further comprises linking logic to link the trusted third party anonymous certificate to the second trusted third party anonymous certificate, and the linking specifically is: associating two or more certificates as being issued to the same platform.