AFAIK Windows only treats it like a TPM (*), so you could just talk to it using TSS to access whatever keys it has just like Windows itself would. "Access" != "

AFAIK Windows only treats it like a TPM (*), so you could just talk to it using TSS to access whatever keys it has just like Windows itself would. "Access" != "export", of course, because it's an HSM. (*) A TPM that is special for being baked into the CPU, and for being a known quantity that can thus be updated via Windows Update and used for Secure Boot attestation, but a TPM all the same.