> TPMs are a red herring here though, as the TKey is not a plausible replacement for a TPM, which exists to measure a platform boot process. There's not really any way to use a TKey for this, since a) you'd have to load firmware at every boot before the first measurement is taken (i.e., before the BIOS even starts running), which no PC is setup to do, b) you would still be vulnerable to classical MitM of the device, as for any discrete TPM, and unlike modern functional TPMs.

Well, yes, the TKey specifically is missing bits and pieces that makes it unsuitable as an actual TPM on current computers. We could however add them in. We wouldn't have to load the firmware at boot time for instance if like you suggest in your article it is stored in a flash chip and automatically loaded by the discrete HSM itself at boot time. We still need the option to reload new firmware from another source or change the flashed firmware for maximum flexibility, but at least this problem could be solved.

The other point about discrete TPMs being vulnerable to MitM attacks… yeah, I haven't found a way around that. As far as I know, I don't see a way around executing one bootloader on the PC, and have the TPM measure another bootloader (say the one approved by Intel and Microsoft). My web searches around that are eerily silent, and the best technical explanations I could glean tend to show that measured boot and discrete TPMs are fundamentally incompatible.