[mjg59]

If you have secure boot enabled, how does the attacker replace the kernel or bootloader?

[lostmsu]

Pull the drive out, insert it into his machine, replace, then insert it back.

[mjg59]

And now the signature doesn't match, so the system doesn't boot

[lostmsu]

Which signature?

[mjg59]

The signature that's validated by secure boot. If you don't have secure boot turned on then there's no point in verifying PCR 7, because all PCR 7 contains is the secure boot data.