I discovered that we don't turn on CONFIG_RANDOM_TRUST_CPU: https://lwn.net/Articles/760584/ We probably should.
Patch sent to linux-yocto to include this for intel-common BSPs. Will update SRCREVs once that has been merged.
This has been enabled for intel-common BSPs in meta-intel for 4.19 and above.