What if the USB Linux stick loads the NTFS partition and runs the entire Windows OS inside of HyperV? Are users supposed to learn VM escape shellcode to check their PC each time? ("You fat-fingered your shellcode? Well you deserve to be owned!")
The TPM machine check would fail in that case and the TPM would refuse to provide the crypto keys to decrypt the copied NTFS partition. That's the whole purpose of SecureBoot, to detect hardware/software changes (including HyperV).
