[Gigachad]

Looks like you can either password protect grub or have the kernel start command part of the list of things the TPM checks before unlocking the key.