Indeed, it would be easier to use the existing cpuid data in struct kvm_vcpu, because right now there is no way to ensure that they are consistent.
Why is KVM_SET_CPUID2 not enough? Are there any modifications done by KVM that affect the measurement?
Then we get the situation that KVM_TDX_INIT_VM must be called after 1 vcpu is created. It seems illogical that it has chance to fail the VM scope initialization after 1 vcpu is successfully created.