Software trust has to stand on something physical
Hardware provenance is a verifiable record of a physical component's origin and custody chain — where it was manufactured, who handled it, and what happened to it before it reached final deployment. This is a genuinely distinct concern from software supply-chain trust, which verifies code and build artifacts; a physically substituted or tampered hardware component can undermine every software-level protection running on top of it, since those protections generally assume the underlying hardware is exactly what it claims to be.
A device with a compromised component at the hardware level can potentially defeat trust anchors and attestation mechanisms that were built assuming the hardware itself is trustworthy — the entire chain of software-level verification is only as sound as the physical foundation it was built on, and no code review or signature check reaches back far enough to catch a component that was already substituted before the device ever powered on for the first time.
A concern prior to, and separate from, software supply chains
This is why hardware provenance deserves attention as its own concern, separate from and prior to whatever software-level verification runs afterward: verifying components at the point of procurement, maintaining custody records through manufacturing and shipping, and treating a break in that chain of custody as seriously as a break in a software build pipeline's own integrity. Organizations that invest heavily in software supply-chain security while treating hardware procurement as an unexamined given have secured one half of the actual trust chain and left the other half to assumption.