This is actually trivial. Corporations and authorities have massive resources expertise and time. Private individuals have none of these things so you favor the small fry in every interaction.

You only punish false reports by individuals which are obviously proven malicious and knowingly false while you screw companies and authorities to the wall for the slightest lack of due diligence.

Should have known that the person who you put through the wringer was innocent because they live in a different state and only vaguely look like the person in bad cctv but ai told you it was them 5 million from both company and gov and principals on both sides get fired and on the government side bannied from any gov job.

You can trivially treat both classes differently and get the desired result

So am I correct in understanding that this could be used to make a tool to unlock any encrypted disk that relies on the tpm whilst something like luks or indeed any solution that doesn’t rely on the bios being secure would be fine.

Note I’m talking about a stolen laptop not an evil maid situation.

This breaks protection not provided by legacy bios you are basically always at the degree of insecurity provided by this exploit.