If you want secure boot then you want the BIOS/UEFI to verify a signature on a boot loader which then has to verify the signature on a kernel which then has to

If you want secure boot then you want the BIOS/UEFI to verify a signature on a boot loader which then has to verify the signature on a kernel which then has to verify filesystems' ubberblock checksums (which should be signed in the boot manifest, which signature should be verified too).