TPM 2.0-backed non-exportable OpenPGP key via tpm2-pkcs11 + gnupg-pkcs11-scd; presents a ready GNUPGHOME for a pass vault (generate/unlock/status/revoke).