through boot, a PCR with the vTPM is prolonged Together with the root of the Merkle tree, and afterwards confirmed from the KMS before releasing the HPKE private important. All subsequent reads through the root https://honeypotz.net