Booting uses PARTUUID to find the right boot partition (there's a systemd standard for finding the right partition automatically if the right UUID is set, but n

Booting uses PARTUUID to find the right boot partition (there's a systemd standard for finding the right partition automatically if the right UUID is set, but nothing seems to actually use it? I did set up the right UUID from the standard just to document things). Encryption is via fscrypt, which isn't as good as FDE - not sure if FDE is impossible here, but I think this is enough security for the typical adversary. If a three-letter agency was a threat, I'd be toast anyway. Custom kernels: Module loading is disabled - I've enabled everything that a normal install would load and added some netfilter things. Firmware is compiled into kernel too. Of course custom key is used for secure boot.