It looks like this thing bundles ca.ipxe.org and ca.netboot.xyz certs. It also makes a SHA256 checksum of each boot disk, and creates signed signatures for all

It looks like this thing bundles ca.ipxe.org and ca.netboot.xyz certs. It also makes a SHA256 checksum of each boot disk, and creates signed signatures for all source files. But it is not verifying signed checksums of the bootloaders themselves, which you would expect to be probably the most important part of running an OS downloaded over HTTP from random mirrors you don't know. Also, thanks for giving us your encrypted secrets database, as well as your S3 secret access keys, author?