I'm not sure what you mean. They do have a secret key used for hardware attestation, but to my knowledge it's not supported anywhere and your own build would pass attestation just as well. For apps outside the core you wouldn't even have to do that much - just fork them and install your own.
