> TPM isn't for "security" in the abstract, it's fundamentally for authentication

What on earth do you think I make my users present keys for???

You know all those guides saying "you should never copy an ssh private key over the network. Make a new one for each device" that every idiot dev ignored? Now I can enforce that.

Yes, this would stop people from asking for my key when they choose the wrong one for a new AWS EC2 instance.

Not a chance. It is my key.