Honestly the fact that in 2026 it's practically impossible on Linux for a service to have its own keys in the TPM or other box where (a) it can't get the key material out and (b) nobody else can access it is a fucking disaster.