This is the sort of stuff that has me concerned for some of the newer all-or-nothing security like TPMs being used as sole sources of auth (e.g.:bitlocker), "pa

This is the sort of stuff that has me concerned for some of the newer all-or-nothing security like TPMs being used as sole sources of auth (e.g.:bitlocker), "passwordless" stuff that boils down to 1FA auth (pins/codes protecting the thing don't count), PATs,etc... it feels like people designing security products keep getting out of touch with actual threats that impact people. My point is, they don't take a defense-in-depth approach. Their new solution is so amazing you don't need anything else. Drivers, Kernel module and boot time software should be signed by a trusted cert, but how about requiring a boot password where every module and bootware must also be decrypted or MAC validated by KDF output of that password? Yubikeys are amazing but also have passwords? SSH keys are great but again, also have passwords? PATs suck! but if shitty attempts to lock you to a platform work for you then maybe also have a yubikey or some other off-device auth? I can just imagine a world where everyone is hooked on PATs and FIDO2 and one leak/vuln impacts billions! Lol. The person who brings a knife in addition to a gun to a gun fight wins when everyone runs out of their silver bullets.