explainer for shim key sources and flow
There were a lot of questions regarding the shim authentication flow and source of keys when reviewing my stboot + TPM proposal. A detailed treatment of the shim's verification algorithm was out of scope for my proposal so I wrote a separate document.
/cc @nisse