request command line tool to generate usb boot hashes

Is your feature request related to a problem? Please describe.
Heads provides the option to require signed boot hashes when booting from USB. However it is left to the user to make all the hashes which are then to be signed with the kexec-sign-hashes utility.

Describe the solution you'd like
Making the boot hashes is too complex. If it was only a matter of sha256sum /boot/* > kexec_hashes.txt then there would be no problem, but heads complains about missing tpm primary.handle, missing kexec_tree.txt and there is also no rollback counter. Trying to figure out how exactly to format each of the different hashes heads expects to see for signed boot is difficult. It would be nice if there was a simple tool kexec-generate-hashes for example that could generate the hashes in just the format heads wants to verify them in rather than require the user to figure out the formats and files. Heads already generates the hashes for the primary boot device so it seems it would be fairly easy to reuse the code to make a tool for the user to do the same for a usb.

Describe alternatives you've considered
Trial and error of trying to manually create all the hash files using source code as reference.

Start by tracing how Heads generates hashes for the primary boot device and how kexec-sign-hashes consumes them. Compare that format with the USB verification errors for tpm primary.handle, kexec_tree.txt, and the rollback counter. Done means a command-line tool generates all hash files in the format Heads verifies for signed USB boot.