Dang your right. I figured the TPM was part of secure-boot validation. But given some extra thought, it is clear that verifying a signature does not require a

Dang your right. I figured the TPM was part of secure-boot validation. But given some extra thought, it is clear that verifying a signature does not require any secrets.