See also https://bugs.chromium.org/p/chromium/issues/detail?id=855667#c7

So it sounds like importing keys to Chaps already supports this. Thus, we can either close this feature request (and make implementations responsible for generating the key, then importing), or look at adding an attribute to the generation request to indicate it should be generated using Chaps' stack (which should be robust and secure, compared to a dozen different other ways), but not TPM backed.

Also, note that there is a work going on already to speed up signing with tpm-backed keys, which may reduce the need in software-backed keys. See  issue 851053  -> issue 851113.