[zlynx]

You need Secure Boot or something like it to start the security chain when using a TPM to save keys to unlock the hard drive, for example.

The TPM can be used to verify that the next boot stage has not been compromised, but it cannot do the first step, so if bad code inserts itself right up front it can lie to the TPM and unlock the security keys under malware control.