And to do that, a TPM is needed to keep the keys/signatures