Where do the keys get strored? Flash in the CPU? UEFI variables? A second flash chip on the motherboard?

it depends amd mostly uses its psp (platform security processor) of course security depends on amd's enclave. it basically uses ARM TrustZone, microsoft explained it in a paper: https://www.microsoft.com/en-us/research/wp-content/uploads/... so the internal storage is eMMC with RPMB and a hardware fuse