>Maybe I missed something, but the boot partition can and should be encrypted as well (depending on the threat level I suppose). It should be authenticated. Yo

>Maybe I missed something, but the boot partition can and should be encrypted as well (depending on the threat level I suppose). It should be authenticated. You can sorta get there with encrypting boot and keep a boot loader off the main computer, if you don't have secure boot. But the better option is to always setup secure boot and sign all entires. Using a unified kernel image you would end up protecting the initramfs, microcode and the kernel with secure boot. https://wiki.archlinux.org/index.php/Systemd-boot#Preparing_a_unified_kernel_image https://wiki.archlinux.org/index.php/Systemd-boot#Preparing_...