Actually there is Credential Guard which in concept does this. But Microsoft only use this for Kerberos/Domain stuff and it's only supported in Enterprise Edition.

They only don't support this because Windows is market segmented and Microsoft have fuck all product management and direction that isn't run by an army of crack smoking monkeys.