tpm2-pkcs11

Is that not what e.g. this project allows you to do? https://github.com/tpm2-software/tpm2-pkcs11

This is a great idea. I now exclusively use SSH keys on hardware security modules of some kind. I use "Secretive", a mac app that does the same, plus a yubikey using yubikey-agent (https://github.com/FiloSottile/yubikey-agent; there are too many complicated ways to use SSH keys with a yubikey this is one of the friendliest ones). Depending on the security and frequency of which I access the service impacts whether I need presence confirmation or use secretive versus the yubikey. I would be remiss to mention there are existing SSH TPM projects, not sure how this one differentiates. It seems to at least have the user experience pretty simple, similar to yubikey-agent (and secretive), and unlike some of the existing solutions which have quite a few extra steps: https://github.com/tpm2-software/tpm2-pkcs11/blob/master/doc... I really love it

Perhaps tpm2-pkcs11 and its ptool are approachable enough? https://github.com/tpm2-software/tpm2-pkcs11/blob/master/doc...

You can also do it with PGP smartcards like the open-source NitroKey [0]. For a more analogous equivalent though, there's the tpm2-pkcs11 project [1] that uses anything conforming to the TCG TPM2 spec [2], which includes a surprisingly wide variety of hardware, including many motherboards. My XPS 13 for example has one. What I'd really like to see though is something that uses the TPM for host verification rather than client verification. I'd love to be able to ensure that the only way for a machine to give me the host key I expect is for that machine to be hardware I own running verified software (e.g. verified by Secure Boot with a custom key). [0]: https://www.nitrokey.com/ [1]: https://github.com/tpm2-software/tpm2-pkcs11/blob/master/doc... [2]: https://trustedcomputinggroup.org/resource/tpm-library-speci...