Except for the Enrollment Key, that's how TPMs work. And the EK is not so much an issue of "control", but of "privacy" - and as long as you control the OS, acc

Except for the Enrollment Key, that's how TPMs work. And the EK is not so much an issue of "control", but of "privacy" - and as long as you control the OS, access to that key (or any other) can be mediated properly.