Comment # 18 on bug 1208766 from Björn Bidar

(In reply to Joey Lee from comment #3)
> After the Tumbleweed kernel be locked down, the only way for using
> hibernation is disabled EFI secure boot. User can use UEFI firmware UI to
> disable secure boot, or using mokutil to disable validation from shim layer:
> 
> mokutil --disable-validation
> 
> 
> On the other hand, upstream is working on a solution with TPM2: 
> 
> [PATCH v5 00/11] Encrypted Hibernation
> https://lkml.org/lkml/2022/11/11/1229

Why is such a patch set needed when the volume that stores the image is itself
encrypted?