If you run into the link to this, is love to read it. Proper, modern, pcrphase binding with a signing key should remove these firmware update issues irt the raw pcr value changing
https://github.com/tailscale/tailscale/issues/17622
https://news.ycombinator.com/item?id=46532666 (direct comment link, more discussion on the issue in the parent)