3 ms·

I'm not even sure why OS exposes TPM directly to applications instead of having a virtual store for credentials that could be backed by whatever. UPD. nvm, tha

• amluto 2mo ago
  > having a virtual store for credentials that could be backed by whatever. An OS can do this. But it’s extremely awkward for an OS to do so in a way that is itself TPM-backed without kludging something disgusting on top of the TPM2 formats using OS-managed state, severely restricted functionality, and probably losing compatibility with the broader TPM ecosystem. It didn’t have to be this way. The TPM authorization format could have had a field like “OS-managed identity” that the OS’s TPM stack would validate. And maybe even cool features like a standardized way for the OS to measure an application and for the application to use those measurements in its authorization. But none of this exists.