Except for the Enrollment Key, that's how TPMs work.

And the EK is not so much an issue of "control", but of "privacy" - and as long as you control the OS, access to that key (or any other) can be mediated properly.