if the fix is moving to uki plus systemd-cryptenroll, does that actually remove the “patch initramfs and dump the key” class of break, or is it still just shifting where the tpm handoff happens?