* As others have pointed out, what if you're locked into using Windows, Windows requires TPM, and TPM implements something you don't like, for example DRM or it snoops on you. Maybe you have to let it scan your drives, maybe your TPM doesn't like your politics.
It's not a guarantee, you may consider it FUD, but you can't tell me it's impossible - you can't even promise me it won't happen.
The TPM is fundamentally about storing cryptographic keys, platform integrity checks, unique IDs, etc. It is already used for secure logins by the Windows OS. Microsoft are successfully enforcing your email, ID, logins, etc, to be associated directly with your unique hardware.
One day you will request a video from Netflix or Youtube, and your device will be the only device in the world that can view it. You might think to screen record, but the OS does not allow it. You might think to record it via an external display, but this has to interface with the TPM. You decide to record your screen from your phone, but the phone's TPM recognises that the camera tries to record DRM material.
Don't get me wrong, security devices should exist 100%. But. It should never be forced.
TPM isn't capable of the outlandish claims you're making. It stores textual content in PCRs, and is extremely limited at that, not at the very least of in size.
Unique IDs of a system don't require a TPM. Microsoft uses unique IDs from various hardware to bind a product key to a particular device, and has been doing that since the XP era.
Intel and gfx vendors already provide secure DRM paths. TPM isn't capable of doing so.
> Don't get me wrong, security devices should exist 100%. But. It should never be forced.
They should be forced otherwise users would continue leaving themselves open to attack. Security has moved on from ACLs. Microsoft recognizes the need for things like VBS to protect against modern threats, which in turn requires TPM.
Apple has been doing this for roughly 15 or so years now with no fanfare on consumer devices. TPM has been around on x86 since the late '00s with little-to-no fanfare.
Operational reasons:
* You often replace hardware and move disks, etc, around
* The TPM is not compatible with hardware that you have: https://wiki.archlinux.org/title/Trusted_Platform_Module
* You have a TPM that is too old: https://www.dell.com/support/kbdoc/en-uk/000132583/dell-syst...
* Your TPM is damaged
Security reasons:
* For some reason the TPM is actually seriously compromised itself (i.e. RCE or firmware backdoors):
- https://www.reddit.com/r/sysadmin/comments/1akxbfn/youtuber_...
- https://www.beyondidentity.com/resource/cybersecurity-mythbu...
- https://www.bleepingcomputer.com/news/security/new-tpm-20-fl...
* You have an alternative security model, i.e. PTT: https://uk.crucial.com/support/articles-faq-ssd/alternatives...
* As others have pointed out, what if you're locked into using Windows, Windows requires TPM, and TPM implements something you don't like, for example DRM or it snoops on you. Maybe you have to let it scan your drives, maybe your TPM doesn't like your politics.