[p_l]

TPM 2.0 provides encrypted sessions specifically to handle this problem.

Of course you need to first use them...