“Third-party applications can access a device's unique TPM-based ID via an API without restriction.”