This is basically what Google Titan does. Most vendors don't want to add an additional root of trust chip (and I'm not sure there are any good ones available to buy).