I'm still not completely sure about the role of using an HSM or TPM on a device when it comes to storing private keys for security purposes.

My use case would be using TLS with an embedded device which contains a unique self-signed device certificate signed by a root CA private key. The device authenticates itself on AWS using the device certificate and uploaded root CA certificate.

The device therefore has two private keys which nobody should ever get access to.

Does an HSM or TPM completely decrypt these keys and store them? However, what happens when the software needs these keys for the authentication process? If it obtains the TPM or HSM for the keys, surely they will be decrypted and a hacker could then access them if they got into the system? Thanks in advance.