My understanding is that secure boot works by verifying each stage in the boot process before proceeding. So first, UEFI or booting firmware will validate the signature of the bootloader, then kernel, applications etc. before loading.
When an OTA update occurs, I assume that the signature for the kernel and applications will change? How does the booting firmware then know how to validate the new kernel and applications on the next startup, as the signatures will have changed?
Now this brings me to the case when using a TPM for encryption and verification. Shouldn't the firmware be signed and encrypted by using a key which is specific for the individual machine which is stored in the TPM? After an OTA update, again how would the modified software boot for the first time when the new signatures are not known yet? Thanks in advance.