Show HN: MTLS with keys never leaving the TPM

Author here, thanks for posting this. Been going deeper on TPMs lately, working through machine identity after remote attestation, the point where you've proven a machine is genuine but still need it to prove which machine it is to something like a secret store. crypto/tls takes any crypto.Signer, so this library slots a TPM-resident ke in and signs the handshake without the key ever leaving the hardware; happy to answer anything on the library or the attestation side.