It is just SecureBoot which is officially supported by many mainstream distros.

I unlock encrypted partitions with a passphrase, not TPM.