[justincormack]

VMs don't have TPMs as they are hw devices, although you can run a software TPM (potentially backed by the host TPM) and pass it to them, which you might want to do for this use case.

[wolvoleo]

That would be nice, in that case you can extract also keys that apps store in there. Interesting, I'll try that out.