This proposal isn't meant for preventing scraping, and isn't useful in any way for that. The only TPM operations that it makes available are: 1. Create a new k

This proposal isn't meant for preventing scraping, and isn't useful in any way for that. The only TPM operations that it makes available are: 1. Create a new keypair on the client, and register the public key with the server. 2. Respond to a challenge from the server by signing a challenge string with the private key. There's no attestation that the original key was created on a TPM. Nor is there any kind of support for non-signing TPM operations (like increment-only counters). Anyone trying to use this API for scraping prevention would be badly disappointed, they'd just find that a scraper could mint an unlimited number of keys very cheaply, and that those keys would be indistinfuishable from those created by real users.