I'd stick to having a unified vfat boot+EFI partition mounted at /boot. systemd-boot is the simplest bootloader and it doesn't support loading it's config and k

I'd stick to having a unified vfat boot+EFI partition mounted at /boot. systemd-boot is the simplest bootloader and it doesn't support loading it's config and kernels from non-vfat partitions anyway. Just make a 5GB boot+EFI partition so you can store plenty of kernels or even a recovery image. For security, I recommend following Madaidan's Insecurities Linux hardening guide, it has good explanations of most of the same sysctl options and kernel flags. [1] The only option that may be best left disabled is `init_on_free=0` since this is one of the few options that has a measurable performance impact (besides the normal spectre/meltdown related options). For NTP, systemd-timesyncd works fine and is probably the default for any modern distro. Desktop security is still a nightmare, if you use a Wayland based desktop environment and Pipewire for audio/video streams then maybe in 10 years you'll a secure clipboard and no unauthorized keyloggers. [1] https://madaidans-insecurities.github.io/guides/linux-hardening.html https://madaidans-insecurities.github.io/guides/linux-harden...