Embed Notice

(if you're wondering how this works, it's a bit like LUKS - the TPM has a small, on-chip bit of cryptography and then all the private key material can be stored in bulk, anywhere, but is unusable without sending it to the TPM when you need it, where it will use the local crypto to decrypt the privkey, do the operation you needed it for, and then return only the result you requested before forgetting the cleartext private key from the TPM memory)