TPM counter for rollback prevention

[osresearch]

A TPM counter should be employed to detect minimum software version. Can this be done in a way that doesn't require a per-device counter or per-device signatures?

[osresearch]

Sealed keys could have a counter policy, but.... that is a per device sort of thing.

[osresearch]

TPM counter documentation examples isn't working, issue filed: tpm2-software/tpm2-tools#2176

[osresearch]

Documentation has been updated and it is now in use in the safeboot luks-seal.