TPM: workaround to enforce PCR updates across suspends