It doesn't block you from running anything.
I figured the TPM was part of secure-boot validation. But given some extra thought, it is clear that verifying a signature does not require any secrets.
Yet
I figured the TPM was part of secure-boot validation. But given some extra thought, it is clear that verifying a signature does not require any secrets.