The threat model is the Evil Maid Attack. I found Secure Boot + UKI + TPM PIN (God forbids automatic unsealing) + FDE to be great for both security and usabi

The threat model is the Evil Maid Attack. I found Secure Boot + UKI + TPM PIN (God forbids automatic unsealing) + FDE to be great for both security and usability. [0]: https://en.wikipedia.org/wiki/Evil_maid_attack https://en.wikipedia.org/wiki/Evil_maid_attack