Enable disk encryption

[toanju]

What would you like to be added:

Make use of the TPM and enable disk encryption.

[nkraetzschmar]

should be doable mostly by reverting the changes to _usi to mostly align with upstream (and maybe moving the additional output artifacts to a separate feature flag) and then building with _trustedboot_tpm2. Otherwise we'll need to look into how exactly the _usi here differs from _usi in upstream GL and how to make that compatible with _trustedboot_tpm2.

(TPM on its own without trustedboot does not really make sense, as the TPM keys must be bound to some PCR like the secboot state, else keys can trivially be extracted)