> Depends on the config. From trivial (old BIOS, no protection) to ~impossible (locked uefi doing secure boot).

so locked means i can not boot any other system until its unlocked? How do i do this? is there another passphrase involved? do i have to reset the chip before anything else is booted? i am probably not that well informed on this topic.

> You cannot copy the key once it's moved into the TPM chip.

obviously not! but i can just use it right away without figuring out your password. That is assuming i can fool the system to trust me. It requires the same level of access but in case of the passphrase i am blocked until i solved this. If i use your key immediately to ensure my own keys are trusted i am already done.