Are private keys regenerated, migrated or separately enrolled when changing form factor?

Short answer

Changing form factor typically requires separate enrollment of hardware-protected keys rather than casually exporting private keys. Whether regeneration, controlled migration or dual enrollment is supported is deployment-specific and not asserted here without engineering confirmation. Export policy cells remain editorial_task in the hardware matrix.