@tthbaltazar @mjg59 One common use of a TPM is to have a full-disk-encrypted partition which is automatically decrypted as long as the full both path (firmware, bootloader, kernel, initrd, kernel command line, etc) is unchanged. Try to access it any other way (single user mode, booting from a USB stick, etc) and it won't automatically decrypt (you'd have to use alternate means, like a recovery passphrase).