Andy suggests one mode of operation: a truly read-only boot filesystem that the kernel itself can't modify. And there is general agreement from all parties to a

Andy suggests one mode of operation: a truly read-only boot filesystem that the kernel itself can't modify. And there is general agreement from all parties to add a kernel command line flag to support that use case. Otherwise, on a more general-purpose computer with a writable /boot/, some verified boot like secure boot is required to ensure that your chain of trust is established.