* Hold the CA key in the TPM on Windows
A non-exportable machine key in the TPM, or in software where there is
none, signs as the Secure Enclave key does on macOS.
* Require the TPM for the Windows CA key
A failure to open the TPM fell back to a software key, which minted a new CA
and kept it for good. Fail instead, as macOS does without a Secure Enclave.
* Use the windows crate for the TPM key
---------
Co-authored-by: Ian Graham Martinez <[email protected]>
