> Isn't that what you want on that platform? ADCS even supports issuing remote-attested TPM certs via EK, no need to reinvent the wheel.

This is really cool. Did not know about it: https://learn.microsoft.com/en-us/windows-server/identity/ad...