I use an encrypted private key, the corresponding certificate, etc. to define the configuration of netplan with eap-tls authentication. Everything is fine so far but I have to protect the private key and preferably involve the TPM. My question is: once I have the new set of keys, the certificate, how will I provide the encrypted private key? right now it's simple: client-key: /path/to/encrypted.key Can the private key stored in TPM be visible via an encrypted file system or something else? Thank you beforehand for your help.