TPM Event log does not appear to be passed to the kernel when Secure Boot is enforcing. To restore this critical functionality, revert back to our previous 2.06 grub2 which has this support and all SBAT-related CVEs patched.
This reverts commit 26d9bca