Non-HOTP setups need to reboot after signing, otherwise trying to boot and TPM DUK unsealing fails because PCR5 doesn't match

[tlaurion]

Recently added gating forgot about non-HOTP users which doesn't seal/unseals secrets with usb modules not loaded

Sorry folks, Heads kinda became HOTP USB centric recently, will fix this eventually; for now you can mitigate by rebooting when TPM DUK doesn't work because PCR5 doesn't match (sealed without sub modules loaded)

[tlaurion]

Non-HOTP setups also need to reboot after signing, since signing /boot loads usb drivers which modified PCR5 measurements which otherwise will fail tpm duk.

[tlaurion]

Nope, gating makes sure /boot files are signed with key on usb security dongle.