Laptops and servers with a TPM can do encryption in a way that requires the specific device to decrypt.

One time setup

# setup.sh

#!/bin/bash
tpm2_createprimary -c primary.ctx
tpm2_evictcontrol -c primary.ctx -o persistent.ctx
tpm2_create -C persistent.ctx -u key.pub -r key.priv

Encrypting a secret

# encrypt.sh

#!/bin/bash
tpm2_load -C persistent.ctx -u key.pub -r key.priv -c key.ctx
tpm2_rsaencrypt -c key.ctx -o ciphertext.enc plaintext.txt
rm key.ctx

Remotely encrypting a secret

# export-publickey.sh

#!/bin/bash
tpm2_load -C persistent.ctx -u key.pub -r key.priv -c key.ctx
tpm2_readpublic -c key.ctx -f pem -o pubkey.pem

Copy the pubkey.pem file to the destination host.

# public-encrypt.sh

#!/bin/bash
openssl pkeyutl -encrypt -pubin -inkey pubkey.pem -in plaintext.txt -out ciphertext.enc

Decrypting the secret

# decrypt.sh

#!/bin/bash
tpm2_load -C persistent.ctx -u key.pub -r key.priv -c key.ctx
tpm2_rsadecrypt -c key.ctx ciphertext.enc
rm key.ctx