I think your central thesis is that at the time of TLS establishment, why not use PKCS11 (with a cert signed by a CA that has validated a TPM certification), and I agree: services should probably integrate via PKCS11.
I just read your original comment "is this any conceptually different from using PKCS11 provider for TPM in OpenSSL?" and yes, I agree it's not conceptually different.
That said, TPM quotes are attesting the value of TPM PCRs which are just registers of hashes (representing the state of the machine).
When making a CSR, you can use https://tpm2-tools.readthedocs.io/en/latest/man/tpm2_certify... to attest a key is TPM-resident.
I think your central thesis is that at the time of TLS establishment, why not use PKCS11 (with a cert signed by a CA that has validated a TPM certification), and I agree: services should probably integrate via PKCS11.