I just read your original comment "is this any conceptually different from using PKCS11 provider for TPM in OpenSSL?" and yes, I agree it's not conceptually different.

Sorry to have missed that!