in the course of boot, a PCR of the vTPM is extended Together with the root of the Merkle tree, and later confirmed by the KMS just before releasing the HPKE non-public vital. All subsequent reads within the root partition are checked versus the Merkle tree. This makes sure that all the contents of