https://docs.microsoft.com/en-us/windows/security/information-protection/tpm/how-windows-uses-the-tpm https://docs.microsoft.com/en-us/windows/security/informat

https://docs.microsoft.com/en-us/windows/security/information-protection/tpm/how-windows-uses-the-tpm https://docs.microsoft.com/en-us/windows/security/informatio... It's used to store th private key of user certificates, but those are PIN protected presumably. But a key that isn't supposed to be extractible may well be so.