It's possible to encrypt all of /boot while using SecureBoot. That was my solution. It's a little annoying to type the passphrase at boot, but it's entirely doa

It's possible to encrypt all of /boot while using SecureBoot. That was my solution. It's a little annoying to type the passphrase at boot, but it's entirely doable. I did the whole TPM thing previously on a Debian-only machine and it worked great until it stopped for some reason and I haven't had time to revisit. But on my latest machine I wanted to make sure Windows with SecureBoot worked and I was in a rush. So it's encrypted /boot for now. I figure the threat is now that someone could clone the drive and brute force the passphrase and then tamper with /boot.