On dual-boot machines, I've always prefered to use the built-in UEFI boot manager (yes, UEFI has one!). This way, Linux boots using systemd-boot/grub/whaever, Windows using NTLDR and whatever else is there, it uses its native way too. It avoids exactly this, where the TPM doesn't consider that there might be an additional component, properly signed, but might cause havoc with sealed values.