Without bootloader integration, what's the difference between adding a TPM vs an HSM like [0]? Does TPM just have a more standardized interface?
[0] https://www.zymbit.com/2020/11/10/blog-security-module-raspb...
[0] https://www.zymbit.com/2020/11/10/blog-security-module-raspb...
But yeah, I think the idea is TPM is a bit more standardized across hardware, so some software that uses it would not need any tweaks to run on the Pi with a TPM built-in.
But there are USB HSMs, along with smart cards (which are also HSMs). Aren't those pretty standard?
The TPM specification has its own crypto interface that is standard across all hardware, so you can do things like generate a key and perform crypto operations without requiring the hardware implement a particular interface beyond whatever TPM version you require.
There are advantages and disadvantages to both approaches. On Linux, TPMs are implemented in the kernel, and CCID is handled by userspace drivers.