The main difference is that in OSEN, server's identity is authenticated using Anonymous EAP-TLS (and DAA), and still protecting the client's identity (identity is generated based on a private key which is part of the TPM HW module). See https://www.commscope.com/globalassets/digizuite/1527-wp-hotspot-2-0.pdf for an overview and https://en.wikipedia.org/wiki/Direct_Anonymous_Attestation for details on how TPM is used (DAA).

In OWE, no authentication is provided, an attacker can impersonate an AP successfully. It's main purpose is to provide security after the exchange.

The main difference is that in OSEN, server's identity is authenticated using Anonymous EAP-TLS (and DAA), and still protecting the client's identity (identity is generated based on a private key which is part of the TPM HW module). See https://www.commscope.com/globalassets/digizuite/1527-wp-hotspot-2-0.pdf for an overview and https://en.wikipedia.org/wiki/Direct_Anonymous_Attestation for details on how TPM is used (DAA). As this is mainly for server identity, it's usage is limited for provisioning only, and disallowed during operation, typically using a separate SSID.

In OWE, no authentication is provided, an attacker can impersonate an AP successfully. It's main purpose is to provide security after the exchange.