There's support for encrypted communication with TPMs, but if I remember correctly this is almost never enabled by default.