To solve chicken and egg problem. In order to enter password, you need to boot full OS (with keyboard and display drivers, for example); but to decrypt OS boot drive you need a password (or more precisely, some key material derived from the password). So a copy of that key material is stored in a TPM, and provided to software only if measured boot goes as usual (i.e. this is not a Linux booting from USB thumbdrive).

It doesn't (it does heavily push you towards it, but you don't need it), you can edit a group policy in order to be able to store the key on a usb drive or to use a passphrase.

I believe the TPM is where the private encryption key is kept.