Totally agreed on the reduced cruft - when I was modifying the codebase I felt quite comfortable with the code and it's readability. Despite it being someone el

Totally agreed on the reduced cruft - when I was modifying the codebase I felt quite comfortable with the code and it's readability. Despite it being someone else's code, it was understandable and intuitive and I felt at home with it. I could see what to patch and edit, and it worked as expected without surprises. Important for something as critical as a bootloader to use principle of least astonishment. I only picked up on tamper resistance based on the GP as I was wondering if I missed something and ended up patching unnecessarily or was misunderstanding something. It's also possible I'm using a stricter definition of tampering, as in my project I considered removing the SSD and modifying the ESP as being "in scope". I recognise for many that's not in scope, and where you fall back to relying on FDE to prevent booting the system anyway.