The TPM just became a USB stick here: ThinOS 10.x parked its LUKS key in NV, then the PCR 7 fix got bypassed anyway.
trending2
01 02 HP ThinPro’s TPM-sealed LUKS key falls to a tweak in the unencrypted boot partition, since PCRs miss initramfs and kernel.