Maybe I missed something, but the boot partition can and should be encrypted as well (depending on the threat level I suppose). There should be a password for

Maybe I missed something, but the boot partition can and should be encrypted as well (depending on the threat level I suppose). There should be a password for the boot configuration (BIOS), Encrypted boot partition, and user login. Adding a second password check in grub would add additional security, but that seems excessive since you can't access grub without unlocking the boot partition. As for unlocking root, you can create a keyfile that is accessible on the boot partition and have it verified during boot. Be sure to set the perms on it and it's always good to keep a hash of the keyfile to detect changes. Also, firejail is notoriously weak with it's default settings. Even configured, bwrap is more secure but you have to specify specific variables that many may not understand. But there are plenty of tuts on it and a script to open a bwrap shell in it's repo.