Another point in favor of Win10: full-disk encryption is easier to set up as Bitlocker on Windows. Together with the TPM, physical access no longer means easy data access, and you don't have to input a passcode for the encryption either.

There is no good story for tpm-secured booting into a full-drive encrypted Linux OS. What I have now still requires a passcode at boot, and it was still a pain to set up.

I was about to write that you can easily enable full-disk encryption with Ubuntu on install, but then I realised you had a requirement to use TPM for this. Ubuntu doesn't support this mode without finagling, so this wouldn't meet your requirements.

My understanding is bitlocker is using your login credentials as the auth to get the TPM to unlock the disk - otherwise how is it blocking anyone else with physical access getting at data by just turning the power on if there's no auth?

You can enable TPM and PIN at boot that engages with the TPM, or you can just use TPM in which case your disk is unlocked by the bootloader (IIRC, terminology might be off).

The TPM and PIN has protections against brute forcing and offline attacks. The TPM only method for Bitlocker is more similar to FileVault.

So basically, the claim here is that it's easy to visualize linux in Windows than it is on a Mac?

That's swell, but what advantage do you perceive versus... just running linux? I understand if you're a .net shop, but I'm always confused about the lengths Windows users seem to go through to run Linux tools within Windows rather than just running Linux.

Because then I have to run Linux as my desktop environment, and I would rather not.