tee: add private login method for kernel clients