There isn't really a resource limit for TPMs in this respect (the certs are kept on disk along with encrypted key blobs that are just loaded in and out of the T

There isn't really a resource limit for TPMs in this respect (the certs are kept on disk along with encrypted key blobs that are just loaded in and out of the TPM at runtime as needed), but there's no standardised mechanism for a site to provision a hardware-backed cert, so there's no way (eg) Github could give you a unique Github cert and then tie access to that.