You can kind of do that, although the process is a bit inverted. BIOS settings are "measured" into the TPM, into a set of "platform configuration registers" (P

You can kind of do that, although the process is a bit inverted. BIOS settings are "measured" into the TPM, into a set of "platform configuration registers" (PCRs). The TPM itself takes no position on what the "correct" value of the PCRs is; however, it is possible to bind data against the PCRs. For instance, you can bind your disk encryption keys against the PCRs. Then, if the eeprom changes, the PCRs will be different, and the TPM will refuse to give you the disk encryption key. The hardware itself is still valuable in the sense that a common thief cares about, but all of your data is protected, and you are not any more risk of using a compromised system then if the attacket simply swapped the unit for one that looks similar.