Is this use case possible?

Hi,=0A=
=0A=
I'm considering using the TPM for my use case, but the docs are to say at l=
east complicated. So, I thought I simply ask!=0A=
=0A=
I want to do this process:=0A=
1. Create public-private keypair in TPM=0A=
2. Use the public key to encrypt an externally generated AES256 key=0A=
3. Import the encrypted AES key to TPM, decrypt with private key=0A=
4. Use the AES key for cipher operations.=0A=
=0A=
Sounds straightforward, yes? =0A=
We however have a mandatory requirement. The AES key may not be in cleartex=
t in CPU registers/memory in any time. =0A=
=0A=
When I tried to look docs for import/load operations, it left me wondering =
is the key actually cleartext in the memory at some point (or in any reason=
ably brute-force decryptable form?)=0A=
=0A=
 I left out from the list the inner cipher mentioned in the docs, it was un=
clear to me where that key comes from. I'd actually prefer to use ECC for p=
ublic-private, and ECDH to derive the inner key, but I did not see anything=
 but RSA in the docs.=0A=
=0A=
I know very well how to do this with an external HSM device - but I'm ponde=
ring would this be possible with the TPM as well?=0A=
=0A=
Best,=0A=
//Henri=0A=