Yes! I've been wanting a TPM 2.0 extension that lets users provide something like a bytecoded program that runs like a secure enclave: if its hash matches a se

Yes! I've been wanting a TPM 2.0 extension that lets users provide something like a bytecoded program that runs like a secure enclave: if its hash matches a secret's authz, then the program is authorized to use it via well-defined APIs (e.g., sign data), and the bytecode interpreter would keep the program from doing things it shouldn't.