There's also an alternative way to using ssh-tpm-agent - the tpm2-pkcs11 stack provides it, here's a guide for setting it up: https://jade.fyi/blog/tpm-ssh/ Not related to the author, but using that setup personally. Similar considerations as in the OPs TPM notes.