Subject: [bug#63637] For boot-time signature checks (aka "secure boot")

From: Felix Lechner <[email-masked]>
Date: Mon, 22 May 2023 07:46:20 -0700

Hi,

I should have mentioned that the programs can help analyze the TPM 2.0
event log that shows the hashes of so-called Option ROMs. After the
Microblows keys are removed, such embedded firmwares (including,
possibly, on video cards) will only run after their hashes were
enrolled. Not doing so can soft-brick a device.

Kind regards
Felix