I use Clevis to auto-unlock my encrypted root partition with my TPM; this means when my boot partition is updated (E.G a kernel update), I have to update the PCR register values in my TPM. I do it with my little script /usr/bin/update_pcr:
#!/bin/bash
clevis luks regen -d /dev/nvme1n1p3 -s 1 tpm2
I run it with sudo and this handles it for me. The only issue is I can't regenerate the binding immediately after the update; I have to reboot, manually enter my password to decrypt the drive, and then do it.
Now, if I were really fancy and could get it to correctly update the TPM binding immediately after the update, I would have something like an apt package shim with a hook that does it seamlessly. Honestly, I'm surprised that distributions haven't developed robust support for this; the technology is clearly available (I'm using it), but no one seems to have made a user-friendly way for the common user to have TPM encryption in the installer.
In my case, no; it’s all a single machine - it is in the initramfs and uses the system’s TPM to (relatively) securely store the keys.
It can be set up with an attestation server, but you certainly don’t have to do it. The Arch wiki has a really good article on getting it set up.