[blibble]

export doesn't help if it's a TPM wrapped key

and websites can check the attestation on the registration to make sure it came from an apple/infineon/titan TPM