Comment by blibble

3 hours ago

you can merge the initrd + kernel into one signed binary pretty easily with systemd-boot

add luks root, then it's not that bad