Switch to thte same approach as used in suse:
-Try to unseal any persistent handles
-If that works, try to use it on network
-If it didn't work, clear that handle
-When an api key is retrieved, then seal it to pcr 15
-When it's all done, extend pcr15 to prevent the OS from being able to
unseal
Organize el8 specific content to separate spaces for future
development of other OS support
Also, make the diskless initramfs a natural result of
dracut activity, so that normal rpm updates and oob driver
installs produce the expected initramfs without further
intervention.
