I can answer a few of those questions for you, though I am still in-the-dark on the OP.
A TPM requires software to implement it. A TPM is implemented pre-boot, as well as within the OS, so it can be hardware agnostic, and it can add complexity, but predominantly due to initial configuration; Once the TPM is deployed there is no significant additional complexity aside from regularized maintenance scheduling.
Is a physical TPM still a good idea?
That depends on your use-case and the cost associated. a TPM protects key use and transmission through hardware to SIGNIFICANTLY increase processing speed of crypto processes. It generates, stores and limits the use of cryptographic keys to necessity; instead of shouting out the key any time it may be necessary, it is triggered by specific events. It can be used to authenticate platform devices themselves, such that new devices cannot be added maliciously (or on a whim).
It can also protect the computer from picking up mischievous boot processes which may attempt to hamper or out-right alter the boot process (to load itself or another application as active on boot).
In Windows 10 specifically, the OS is designed to take ownership of the TPM; There can be times where the key should be altered outside of the management through Win10, but these are infrequent, and usually revolve around resetting a PC... This has generally been deemed by M$ and the world at large as needless and risky, and M$ has suggested (because they are oft' whimsical with their decision making), that they will no longer be developing their TPM management console, presumably because the devices APIs are (already) available.
It can also be recognized as a replacement for smart card authentication/authorization.
TPM is a requirement for the use of BitLocker, various devices which may require encryption enabled in TPM2.0.
TPM can be used to store certificates in Windows 10.
Lastly, a TPM can also be used to route malware at boot, because it measures the (legitimate) OS, and can validate the integrity of a computer running Windows 10/Server2016.
Note that it is deliverable in Linux as well, I am just less versed in its implementation. Ultimately a TPM is used as a protection/shield around keys used by the OS via hashing, (sha-256), and its boot process itself.
The values of TPM, while numerous are predominantly based in security and key implementation in Windows 10;
It can be used in Windows Hello (fingerprint and dynamic lock do and other authentication devices may use it). It can secure the PIN to log into Windows, helps protect passwords via encryption.
It essentially is used to protect a system against itself at a hardware level, such that malignant programs cannot be deployed on the system; it can also be a significant protection against ransomware, though not in all cases (because of the measurements it takes of the OS).
