Not the person you're asking, but see this reddit comment[0] >If you are using a proper private secure boot setup (not the Microsoft keys, signing keys not acc

Not the person you're asking, but see this reddit comment[0] >If you are using a proper private secure boot setup (not the Microsoft keys, signing keys not accessible to an attacker that remotely compromises your system), you trust that your motherboard implements it correctly, you can safely assume nobody is physically tampering with your motherboard and you're using a variant of GRUB that fully implements secure boot, ESP access gives your attacker nothing. They can't change anything there without breaking the system. [0] https://www.reddit.com/r/linux/comments/7n92ip/linux_boot_partition_encryption/ds0epw3/ https://www.reddit.com/r/linux/comments/7n92ip/linux_boot_pa...