Ironclad Apps make promises like "send us your private data, we promise not to reveal anything about you except through this information theoretically secure differentially private channel". To do so it needs to be running on bare metal, and prove over the network to the user that it is running on bare metal. For instance if it was really running in a VM controlled by an adversary, then the guarantees would be useless as the adversary could leak your information after inspecting the VM's memory. The only way to ensure that you're running on bare metal is with a TPM attestation.
Fine. Where can I go download my TPM key? Perhaps it is etched on the chip or on a sticker?
Nope? What do you mean it's kept from me? Hmm.
No idea how one's initialized at factory. However, I'm totally fine with TPM if I can control one, that is upload my own keys and use it for my own security. Still, there's an issue lurking around, if everyone's got a factory-initialized module with industry's trusted keys and the majority keeps those defaults, users who don't trust may be a minority that will be just ignored thus either left without any entertainment of forced to submit.
> Trusted Platform Module (TPM). Deployed on over 500 million computers, the TPM provides a hardware-based root of trust; that is, it records information about all software executed on the platform during a boot cycle in a way that can be securely reported, via an attestation protocol, to a remote party.
Why does the TPM need to send anything to a remote party? It seems to me TPM was designed much more like a DRM module than a "secure enclave" module.