#TPM

Put your SSH keys in your TPM chip

Modern TPM chips present in most enterprise hardware (required for Windows 11) can store SSH private keys as an alternative to traditional file-based storage or dedicated hardware security modules like Yubikeys. While TPM-based storage offers stronger security than filesystem keys by preventing malware extraction and keeping keys out of memory, it provides less protection than portable HSMs since TPM chips are device-bound and may lose data during BIOS updates. This approach enables organizations to leverage existing hardware for improved SSH key security without additional token procurement costs, though backup strategies become critical given TPM data persistence limitations.