I've got a Windows 10 system that uses TPM to seal a bitlocker key, out of the box. And nothing asks for a PIN prior to the login window coming up. Having to be

I've got a Windows 10 system that uses TPM to seal a bitlocker key, out of the box. And nothing asks for a PIN prior to the login window coming up. Having to be prompted for a PIN to do something as simple as a reboot, isn't a great UX. And also has UI complexities in the pre-boot environment. So? It seems to me this is a big problem for the default out of the box user experience. Edit: Ok after searching the article I can't tell how/where they sealed the key. Bitlocker tells the TPM to measure some things and if that measurement matches was in PCR12 (or whatever is defined) then reveal a secret. That secret is the bitlocker key.