You could store the key (or password to the key) in the TPM in order to prevent BIOS, bootloader or option ROM tampering. An issue is that too many things coul

You could store the key (or password to the key) in the TPM in order to prevent BIOS, bootloader or option ROM tampering. An issue is that too many things could affect the TPM PCR values (for example, plug in a USB stick even though you don't boot from it- I think this is a mistake in the spec), so users get used to typing in the backup password and may not notice that a root-kit was installed.