TPM provides zero practical security. The architecture is fundamentally flawed and most existing implementations are completely broke.
The purpose of this article is to dispel the myth around TPM as some sort of general purpose key locker. Significant money and effort has been invested (wasted) in TPM hardware[16] and certification[17], governments[18][19] and organizations require TPM as shorthand for "we are serious about data security," and well-intentioned individuals work on open source projects and academic research to improve TPM security and find new use cases for it. However, the architecture of TPM has flavours of a LLM generated writing: when you look at it from a distance, it seems to hit all the right notes for a security device (strong keys, side channel protections, fault attack mitigation, key hierarchy diagrams, etc) but if you dig deep into the details, you will realize that TPM was not designed in order to protect against real threats that users face.

https://gist.github.com/osy/45e612345376a65c56d0678834535166