TPMs are... extremely flexible. It's hard to summarize what they can do, but I'll try: - a TPM is a crypto co-processor with HSM-like functionality (e.g., key

TPMs are... extremely flexible. It's hard to summarize what they can do, but I'll try: - a TPM is a crypto co-processor with HSM-like functionality (e.g., key wrapping). - TPMs can be and are used to secure the boot process by having the CPU/ME do a core root of trust measurement of the BIOS, and then the BIOS can do a static root of trust measurement of all the option ROMs and such and the next boot stage for the OS, and the OS can continue the measurement process, and if you're willing to you can make sure no code is ever executed that isn't "trusted". - TPMs have very flexible authorization policies, so you can make sure that use of some key requires multi-factor authentication (biometrics, smartcard, password) or multi-user authentication (two or more users have to authenticate), time of day restrictions, approved root of trust measurements, etc. - TPMs can be used to attest root of trust measurements, authentication status, etc. I recently contributed some tutorials[0] to TPM.dev[1]. [0] https://github.com/tpm2dev/tpm.dev.tutorials [1] https://developers.tpm.dev/posts/14297688