That's why they require the other features (tmp2.0, secure boot, signed kernel)