trustcachectl can load new trust caches into the kernel and query whether a given cd hash is present in a loaded trust cache.