[usr1106]

Yes, that seems a good extra level of defense. Allow unsealing only once. We extend a PCR with random data.

[dist-epoch]

This is what Bitlocker does. There was a recent article about it.