Embed Notice

@bluca @pid_eins @siosm
In my case these keys are solely protected by the fact that you have to have booted at least once to have the TPM release the key to decrypt the drive.

The only thread vector that is still valid considering the actual intended audience is how one would ensure against an attacker with root access permissions enrolling their own signing keys, patching the kernel, and re-signing it. But that probably only applies to expert users configurations only anyway...