There's definitely something to be said about assumptions here. I knew all/most of the mentioned high level details regarding SecureBoot and the TPM. However,

There's definitely something to be said about assumptions here. I knew all/most of the mentioned high level details regarding SecureBoot and the TPM. However, I would have assumed that a TPM-enabled linux distro would have authenticated everything up to the FDE password prompt at a minimum as not doing so would seem to completely defy the point! Turns out this assumption is wrong.