I figured it’s more about ensuring the kernel and boot loading and OS are 100% unmodified by attackers/malware.

If that helps with bitlocker or passkeys or whatever that’s great. But I assume at its base it’s a pure integrity play.

I would think that would also let you know the public key stuff used to communicate with hardware authentication like a fingerprint reader is secure too, but I don’t know how that stuff works well enough to know if that’s true.