base system encrypted using TPM2