> I think more like 5, although the government might start slowly, like only preventing non-TPM devices from accessing "sensitive" online services, e.g. banks or anything that requires a payment.

This has already happened for mobile banking apps on Android: Many of them already use SafetyNet with hardware attestation. The only reason not all of them do require hardware attestation is that not all of the older Android phones support that, which is exactly the situation Microsoft wants to change for TPM. And increasingly, other apps seem to be starting to use root detection and safety net for frivolous use cases such as McDonalds.

None of these have any requirement on some TPM specification. A government can already do as much invasive monitoring as they want, either by forcing citizens to install MITM root CAs[0] or generally requiring invasive identity checks when people sign in, or just limiting what privacy-invasive devices are even allowed to be sold at all. Banks can already go "lol no web frontend for you, go use our mobile app". And neither Visa/Mastercard nor their bank partners are going to allow such strict restrictions that'll surely reduce the amount of impulsive purchases people can make, and you forget that every online payment is already hard tied to your identity via your bank / credit accounts.

> in that you are responsible for whatever is done while you are logged in, unless you report it stolen.

This is only really true for insurance purposes - for stuff like red light cams, the tickets are invalid if you weren't the one driving (which is why some newer ones snap temporary pictures of people in the driver seat in case they end up running the light).

0: https://news.ycombinator.com/item?id=20472179

> I think more like 5 [years]

Please drop the hyperbole, there is already enough of an impedance mismatch here. We're talking about slow moving ecosystems, and social normalizing of new technological restrictions. The current locked boot mess has taken oven twenty years to develop since the Trusted Computing Platform Alliance was founded. The pace of change accelerates, but five years won't even make remote attestation available in browsers. I'd say it's at least 15 years until a significant number of websites would require it. Using it for network access control would take further technological development (probably on the corporate side), and then some kind of crisis to drive ISPs/governments to demand consumer implementation. It's worrying because it's a step on the slow monotonic authoritarian march, not because the sky is falling right now.

>I think more like 5, although the government might start slowly, like only preventing non-TPM devices from accessing "sensitive" online services, e.g. banks or anything that requires a payment.

if that occurs, is that really of microsoft's doing, or of the government and all the other companies that are complicit? I can plausibly imagine a future where microsoft stays its course (ie. it doesn't lock down the x86 platform), but companies still force you to use locked down devices by forcing you to use mobile apps to do online banking. You already sort of see this with messaging apps, where a few (eg. signal) are mobile-only.