It seems that pairing this with the original post, the best outcome is a single shell file, that takes a few arguments, such as device location (USB at /dev/sde

It seems that pairing this with the original post, the best outcome is a single shell file, that takes a few arguments, such as device location (USB at /dev/sde) and username/password, etc, and compiles the bootloader, the kernel, etc from scratch using the most trusted basic sources, and then places that on the target device. Obviously it should also install any additional apps like vim, adjust terminal colors, create and copy your ssh keys to machines needed, and configure any windows managers, etc as well from the single shell command. Making that single shell command as small, reliable, readable, and maintainable as possible is the real challenge.