sbctl with package manager hook for automatically signing on updates etc. keys are just stored on the device, for the typical laptop use-case this is good enou

sbctl with package manager hook for automatically signing on updates etc. keys are just stored on the device, for the typical laptop use-case this is good enough (platform key only used by a single device, no MDA or anything like that)