My approach is to replace the SecureBoot keys with one of my own signing, and sign my own bootloader. Have it boot into Windows unless a specific key combo is p

My approach is to replace the SecureBoot keys with one of my own signing, and sign my own bootloader. Have it boot into Windows unless a specific key combo is pressed, otherwise have it boot into Linux and require a password to decrypt the drive. Plausible deniability and FDE (for the partition you care about at least).