Using the TPM to store the client certificates would prevent malware from stealing them. I have no experience on this, but quick search revealed something[1].

Using the TPM to store the client certificates would prevent malware from stealing them. I have no experience on this, but quick search revealed something[1]. Maybe one use for securely stored client side certs would to mark the computer as trusted. For example now Google is probably using cookies to determine that my desktop is trusted and thus I don't need the two-factor authentication to log in. TPM and client side certs could provide more secure alternative for this. [1] http://blog.habets.pp.se/2012/02/TPM-backed-SSL http://blog.habets.pp.se/2012/02/TPM-backed-SSL