Booting via Shim will result in different PCR 7 values, which mean you can ensure that the OS won't boot if an attacker has subverted a signed version of Shim t

Booting via Shim will result in different PCR 7 values, which mean you can ensure that the OS won't boot if an attacker has subverted a signed version of Shim to execute Windows rather than the expected OS.