Would a TPM serve here, in some hypothetical world where folk were willing to put in the work to do this?
Or I guess I'm asking, naively, what are the functional differences between the TPMs on our desktop/laptop machines, and what smartphones have in them?
> Or I guess I'm asking, naively, what are the functional differences between the TPMs on our desktop/laptop machines, and what smartphones have in them?
A security processor on mobile devices are usually actually like TPM and Intel SGX combined together. I won't say it's better than PC TPMs, but have a very different design.
It would require Microsoft to use a different authentication scheme based on ephemeral signed tokens instead of OAUth to be beneficial for security. That is very unlikely to happen.
That scheme would also only reduce the access timeframe from whatever the OAuth token's lifetime is, to a timeframe constrained to the amount of time the computer (the key) is online.