> For privacy, keys generated from seeds such as the EK and SRK can only decrypt, they can’t sign. Hmm, well, maybe it's for privacy, but there is no privacy b

> For privacy, keys generated from seeds such as the EK and SRK can only decrypt, they can’t sign. Hmm, well, maybe it's for privacy, but there is no privacy benefit to that since one can always do a two round trip proof-of-possesion protocol. (One can also do it in one round trip given a platform and/or EK certificate that proves authenticity of the TPM, if one trusts that proof.) There is a key hygiene reason to have keys that are decrypt-only or sign-only, but not both. In any case, it's accurate that primary keys are decrypt only, and the EK is not just decrypt-only but also restricted. Also, it's decrypt-only, but they can be ECC keys (i.e., RSA is not the only supported algorithm for primary keys), in which case encryption to an ECC public key is just generating an ephemeral key, deriving the shared secret, deriving symmetric encryption keys, encrypting, and sending the ephemeral public key and the ciphertext (decryption is similarly straightforward).