I'm just experiencing a bit of schadenfreude because I've had several discussions in which it was claimed that this configuration relying only on the TPM was entirely secure and I was foolish for relying on a passphrase.