Just a wild guess, but for the case where you removed the TPM (to be able to decrypt) and went back to 17.0.2, maybe you were seeing an issue from 'secure boot' related to losing the TPM values?
