In that case, maybe you could do a sort of replay attack? Take a TPM, record a million or so valid states and their signature, and replay those in order every boot? Assuming the TPM is deterministic on startup and you record enough states that you don't have to loop them before reboot, you would have, in effect, a swappable TPM.
Of course, if you get banned then you need to record a new TPM and use that, and that may be difficult.
A nonce is a token specifically meant to prevent replay attacks. There's no sane reason to assume TPM is deterministic, as that would defeat the purpose of all the security.
You're right, i somehow skipped over that in reading. And you would want a TPM to be deterministic, after all one major use of the TPM is validating the hardware and boot state is unchanged. Is the state except of the nonce deterministic?
Of course, if you get banned then you need to record a new TPM and use that, and that may be difficult.