The TPM just became a USB stick here: ThinOS 10.x parked its LUKS key in NV, then the PCR 7 fix got bypassed anyway.
trending5
01 02 TPM-backed thin-client encryption got bypassed three different ways, then the post argues for UKIs and systemd-cryptenroll.03 HP ThinPro’s TPM-sealed LUKS key falls to a tweak in the unencrypted boot partition, since PCRs miss initramfs and kernel.04 A Challenge-Nonce Freshness Gap in Project Veraison's TPM Reference Schemes, Found by Appraising Application-Layer Action Evidence End-to-End arxiv.orgPaper finds Veraison’s TPM attestation reference scheme accepts replayed quotes if nonce freshness isn’t enforced, then fixes it.05 Need PQC in a firmware TPM, or just smaller builds and stricter locality handling? wolfTPM v4.1.0 tries both.