Comment by dist-epoch

> 3. the automated tpm unlock fails, prompting for a password.

> 4. type in our password.

In a serious security conscious setup this should be a big red flag to investigate. Any unexpected boot password prompt.