I have a HP BIOS that doesn't go into setup mode (required to enroll certs) so I have no choice but to deal with the MS shim.