My understanding is that replay attacks are possible with a TPM, if the consuming logic is flawed. IIRC Microsoft's original implementation of signing Primary

My understanding is that replay attacks are possible with a TPM, if the consuming logic is flawed. IIRC Microsoft's original implementation of signing Primary Refresh Tokens with TPM was flawed in this way.