throughout boot, a PCR on the vTPM is extended with the root of the Merkle tree, and afterwards confirmed because of the KMS right before releasing the HPKE personal critical. All subsequent reads in the root partition https://noransomattack.com