tpm2totp used to do this, eliminating the need to divulge the secret used to unlock the TPM, I now see that it has not seen a commit in 2 years.

I also hear mjg59 is looking into encrypted swap hibernation support, so there's a slim chance there will be some development on the system-attestation front.

Fairly sure that if the correct GPOs are set, there is no need for any shell commands needed for a TPM PIN enrollment.

Windows and macOS both can do FDE with good UI/UX compared to Linux.

What problem is this solving though? The post says they're doing this to avoid typing passphrases. Why would you want the private key hidden in the tpm chip of that device? How will you decrypt if the laptop goes bust or if you move the drive elsewhere?