The TPM can be fully controlled by the user (or ignored altogether). Much misinformation about the TPM stems from the Anderson paper, which mixed up real TPM i

The TPM can be fully controlled by the user (or ignored altogether). Much misinformation about the TPM stems from the Anderson paper, which mixed up real TPM implementation and then-future Palladium concepts and claimed that this all runs in contemporary TPM chips. In reality, TPM is a chip with (rather slow) crypto functionality and a reasonable secure storage whose content can be "sealed" to certain system states. That state information is pushed to the TPM by the host system, since the TPM is a fully passive component. (Exception: new Intel chipsets feature 'Boot Guard' where the chipset pushes some root trust information to the TPM in a way that code on the CPU can't modify - but the TPM is still passive) If you control the firmware, you can build a reasonably secure environment using the TPM. But coreboot (or its libreboot distribution) by default don't even do that with the TPM.