The TPM is un-simulatable, that's the purpose of it.
The hypervisor is included in the remote attestation. The theory is, if you trust the signing keys used in the TPM (i.e. Intel/the hardware), then you can get a message from the remote computer that attests what code is running including the hypervisor. Thus you can conclude that the remote environment is safe against all but quite sophisticated hardware attackers (assuming a modern setup where you can lock cache lines and the TPM is integrated with the northbridge).
The hypervisor is included in the remote attestation. The theory is, if you trust the signing keys used in the TPM (i.e. Intel/the hardware), then you can get a message from the remote computer that attests what code is running including the hypervisor. Thus you can conclude that the remote environment is safe against all but quite sophisticated hardware attackers (assuming a modern setup where you can lock cache lines and the TPM is integrated with the northbridge).