See https://github.com/cockpit-project/cockpit/issues/14313

There doesn't seem to be an answer to "which PCRs are used for a measured boot in Fedora?" We should ask again for RHEL.

This should wait for general clevis support in Stratis, and then tackle the TPM2 pin for both LUKS and Stratis at the same time, I'd say.