Is the TOTP calculation done in the TPM, or on the host? If it's done on the host, wouldn't you be able to read out the persistent secret value just by compromising the host, without compromising the firmware? That means you could turn a transient attack (such as on a partially stateless system) into a persistent attack.