update TODO

diff --git a/TODO b/TODO
index b4fd8f59e79e4bc25569d7c2ffa175a88c044aaf..8b966dc62538cc4e0958dfe551285b270a550dd1 100644 (file)
--- a/TODO
+++ b/TODO
@@ -83,6 +83,10 @@ Janitorial Clean-ups:
 
 Features:
 
+* in uefi stub: query firmware regarding which PCRs are being used, store that
+  in EFI var. then use this when enrolling TPM2 in cryptsetup to verify that
+  the selected PCRs actually are used by firmware.
+
 * rework recursive read-only remount to use new mount API
 
 * PAM: pick auf one authentication token from credentials