Module backend 

TPM 2.0 backend for [confium-store].

Implements StoreBackend and StoreInstance on top of tss-esapi. The current revision wires the trait and configuration plumbing; storage operations return NotImplemented. The real tss-esapi calls land behind the tpm feature flag in the next revision — see TODO.roadmap/18-hardware-keystore-backends.md.

Wire name

The backend advertises itself as "tpm" so the FFI create path can look it up via confium_store::backend::find.

Key-handle semantics

Hardware backends typically do not return raw key bytes; they return handles (TPM persistent object handles). Per the roadmap, put_secret will seal the caller-supplied bytes under the parent key and store the resulting object handle; get_secret will return the handle as the opaque *mut c_void. Signature/KEM plugins that want to actually use the key invoke the HSM-style cfmp_sign_with_handle symbol described in TODO.roadmap/18-hardware-keystore-backends.md. The skeleton does not yet wire this — every operation is a NotImplemented stub.

Structs

TpmBackend

Factory for the TPM backend. Stateless — all per-keystore state lives in TpmInstance.

TpmInstance

One open TPM-backed keystore connection.