I'm looking at NemoClaw's runtime behavior during key operations. The default software keystore shows up clearly in our Falco logs as expected file I/O. But I'm trying to eliminate that pattern.

Has anyone integrated NemoClaw with a hardware TPM for the master key? Specifically, using the TPM as the persistent, sealed storage instead of a file on disk.

I'm curious about the operational changes. Does the agent's startup sequence show a different latency profile when unsealing the key from the TPM? And more importantly, what runtime artifacts would an auditor look for in a SOC 2 control test (like logical access) if the key material never touches the disk?