The threat is that they could do a cold-RAM attack and read the key off the RAM. That does require a bit more physical access than just turning it on. The othe

The threat is that they could do a cold-RAM attack and read the key off the RAM. That does require a bit more physical access than just turning it on. The other big threat is that TPMs are probably cheaply built, and anyone with decent hardware skills can probably pop the key out of the TPM. I haven't seen the TPMs in laptops boasting anything like FIPS-140-2 Level 4 validation or any real tamper proof abilities. But for common users, a TPM+Bitlocker transparently deals with the issue of "left laptop in taxi". Microsoft, AFAIK, allows TPM+Bitlocker in lieu of a smartcard for remote access.