lol, another plaintext file is what looks like the src for the firmware signer for this TPM, with three ECC private keys hardcoded (two are commented out)

there's also the code for the firmware flasher on the device side, and binary for the util that talks to that code, with identical hardcoded key+iv for crypting the buffer transferred over uart (it's china, so as you'd expect the algorithm is SM4-CFB)