This MS covers both of the sthsm repos.

We need the first release to

• have enough functionality to provision HSM's with enough keys for signing, and
• be reviewed.

We can sign the UEFI shim with unreleased software -- no key material or overly sensitive passphrases must be exposed to the sthsm sign efi command.

EDIT 2023-11-06: closing this for now, not on the current roadmap. Revisit release if we're closer to using sthsm for, e.g., shim stuff.