[PATCH docs 2/2] qm: bios/uefi: certificate expiration: mention steps for BitLocker earlier

[Fiona Ebner <f.ebner@proxmox.com>]

Mention the steps required when using BitLocker earlier to avoid users
running the command first and only later reading on.

Suggested-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
 qm.adoc | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/qm.adoc b/qm.adoc
index 27dec2c..e6b7918 100644
--- a/qm.adoc
+++ b/qm.adoc
@@ -1156,17 +1156,8 @@ enrolled.
 
 If the `pve-edk2-firmware` package version is at least `4.2025.05-1`, newly
 created EFI disks contain both the 2011 and 2023 certificates and will have the
-`ms-cert=2023k` marker. For EFI disks created before that, select the EFI disk
-in the 'Hardware' view in the UI and use 'Disk Action > Enroll Updated
-Certificates'. Alternatively, enroll the certificates via the
-`/nodes/{node}/qemu/{vmid}/config` API endpoint. The enrollment takes effect
-when the VM is next started. The
-
-----
-qm enroll-efi-keys <vmid>
-----
-
-CLI command achieves the same, but requires the VM to be shut down.
+`ms-cert=2023k` marker. For EFI disks created before that, you need to enroll
+the certificates:
 
 For Windows with BitLocker, run the following command inside PowerShell:
 
@@ -1178,6 +1169,17 @@ For example, `<drive>` could be `C:`. This is required for each drive with
 BitLocker before proceeding. Otherwise, you will be prompted for the BitLocker
 recovery key on the next boot!
 
+Select the EFI disk in the 'Hardware' view in the UI and use
+'Disk Action > Enroll Updated Certificates'. Alternatively, enroll the
+certificates via the `/nodes/{node}/qemu/{vmid}/config` API endpoint. The
+enrollment takes effect when the VM is next started. The
+
+----
+qm enroll-efi-keys <vmid>
+----
+
+CLI command achieves the same, but requires the VM to be shut down.
+
 For further steps on updating secure boot within Windows and signing the
 bootloader with the new 2023 certificates, refer to the Microsoft support
 articles about
-- 
2.47.3