Author here, thanks for posting this. Been going deeper on TPMs lately, working through machine identity after remote attestation, the point where you've proven a machine is genuine but still need it to prove which machine it is to something like a secret store. crypto/tls takes any crypto.Signer, so this library slots a TPM-resident ke in and signs the handshake without the key ever leaving the hardware; happy to answer anything on the library or the attestation side.