Security with "Use the Trusted Platform Module with Windows Hello"

Thanks for the detailed explanation - it's much clearer now.

So the secret is stored on the TPM - anyone with a Windows Hello prompt authenticates against the whole TPM?
And I assume there is no way to have an additional entropy when prompting via Windows Hello to make this a little harder for attackers? 😄