There's no way to use TPM as a store for these signing keys because they are needed too early in the process? Yes, I expect as a general solution for your cust

There's no way to use TPM as a store for these signing keys because they are needed too early in the process? Yes, I expect as a general solution for your customers it might be overkill, but as this is basically the cutting edge of public domain research on these topics it would nice to know what's possible for customers who would take the risks. Understood, I have more reading to do in to how the EFI shim/flasher works.