So in linux it looks like we just update /etc/default/tailscaled with:

FLAGS="--encrypt-state"

...and hope for the best?

edit: I see this in my logs, I guess it is working:

migrated "/var/lib/tailscale/tailscaled.state" from plaintext to TPM-sealed format