I am reading over https://fedoramagazine.org/automatically-decrypt-your-disk-using-tpm2/ .  However, I am confused about what the most secure PCR I should use on my Lenovo X1 laptop on Fedora such that I don't have to type in my hard disk password when Linux boots regularly, but do if a USB key is booted or if someone manually updates the kernel grub boot parameters.  Currently, I am using 1,5,7.  However, I don't know if that is secure enough.  I don't want to regen/rebind on every kernel update.  What PCR values should I use? In your response, capitalize a few words to stress main points. Please limit the number of words with all capital letters to less than 19.
user