> no secure boot only enforces you run a trusted kernel not that the kernel enforces access controls Yes, I am aware of that. But having DRM that is not comple

> no secure boot only enforces you run a trusted kernel not that the kernel enforces access controls Yes, I am aware of that. But having DRM that is not completely ineffective has a prerequisite that it runs on a kernel that does enforce those access controls. The only way that works is with a trusted boot chain. You originally responded “no” to a post saying that one purpose of TPM is to facilitate DRM.