TPM2 Support

[stv0g]

I am surprised to see that nobody seems to use SOPS with hardware-backed keys in a TPM2 module.

Is this supported? Or what would be the required steps to do so?

Here are some of my initial ideas:

• Support it via age-plugin-tpm

  • Probably not possible for the same reason as the support of age-plugin-yubikey (se Age malformed recipient - invalid type "age1yubikey" #1103)

• Support it via GnuPG (>= v2.3)

  • GnuPG seems to have decent support TPMs as covered in this blog article
  • Use the fallback to gnupg CLI instead of use the Go implementation

[Foxboron]

Can just implement something using the TPM2 TSS key files directly.

https://github.com/Foxboron/go-tpm-keyfiles

https://www.hansenpartnership.com/draft-bottomley-tpm2-keys.html

Judging by the existing keysource implementations it should be fairly trivial to implement?