> You can even trust the hard drive if you use software encryption of all your data. Hard drive replaces your GRUB payload with a compromised one that records

> You can even trust the hard drive if you use software encryption of all your data. Hard drive replaces your GRUB payload with a compromised one that records your encryption key. You lose. You could put your bootloader and /boot on a USB stick, but then you're putting the same trust in the stick. Unfortunately, hardware security is really difficult if your threat model does not assume your vendors are trusted. In fact, I don't think it's actually possible today to get verifiably trustworthy hardware under that threat model.