How far do you go, how do you use the private key to sign something if you can't keep it anywhere?

TPM

You never have the private key, only the ability to ask something to encrypt/sign something