tpm2-pkcs11

You can also do it with PGP smartcards like the open-source NitroKey [0]. For a more analogous equivalent though, there's the tpm2-pkcs11 project [1] that uses anything conforming to the TCG TPM2 spec [2], which includes a surprisingly wide variety of hardware, including many motherboards. My XPS 13 for example has one. What I'd really like to see though is something that uses the TPM for host verification rather than client verification. I'd love to be able to ensure that the only way for a machine to give me the host key I expect is for that machine to be hardware I own running verified software (e.g. verified by Secure Boot with a custom key). [0]: https://www.nitrokey.com/ [1]: https://github.com/tpm2-software/tpm2-pkcs11/blob/master/doc... [2]: https://trustedcomputinggroup.org/resource/tpm-library-speci...