TPM measured-boot attack