in pcrextend we destroy pcr 11, and if we are booted in a kernel that has pcr11 sigs, we cannot use that signature anymore. hence, let's do the nvpcr test first, before doing the pcrextend stuff. Fixes: #39582