[mjg59]

And now the signature doesn't match, so the system doesn't boot

[lostmsu]

Which signature?

[mjg59]

The signature that's validated by secure boot. If you don't have secure boot turned on then there's no point in verifying PCR 7, because all PCR 7 contains is the secure boot data.