Downgrade is an issue as previously signed kernels (before this patch) would be happy with userspace using that TPM config to decrypt the hibernation imagine.

Downgrade is an issue as previously signed kernels (before this patch) would be happy with userspace using that TPM config to decrypt the hibernation imagine. As the previous kernels are already signed, downgrading to them is allowed under the Secure Boot, but booting a new version of unsigned kernel on that machine is not.