Non-repudiable disk I/O in untrusted kernels
Sego: Pervasive Trusted Metadata for Efficiently Verified Untrusted System Services