> TPM is really badly implemented. When you upgrade your firmware, OS, everything can go south.

Could you elaborate ? Firmware/OS should not affect TPM contents ? Otherwise e.g. TPM-reliant Windows installs would break ?

In addition there are cloud scenarios where your VM has a TPM and you want to e.g .stop a malicious actor poaching your VM and running it elsewhere.

Having the tailscale TPM tied to your cloud hypervisor prevents the "lift and shift" attack.