* What if the initramfs was rebuilt every time the OS was upgraded.* On most distributions, they already are if the kernel changes in anyway. This is what ends

* What if the initramfs was rebuilt every time the OS was upgraded.* On most distributions, they already are if the kernel changes in anyway. This is what ends up filling up your /boot partition. Then for every ordinary boot, immediately after disk decryption, we keep the disk decryption password in memory for just a little bit longer, and use it to check the signature on the initramfs before continuing with the boot. You can just reuse the existing architecture of secure boot/tpm to store public keys (although GRUB is a disaster and will likely break your boot chain of trust). You normally can't add additional keys unless the system is in setup mode. But, the process to add a self signed key is not user friendly and you'd still need to store the private key on disk to sign additional images, which malware can access. There is a process to generate something known as a UKI, where it can be a signed kernel/initramfs verified by the firmware secure boot, but I believe only Red Hat has keys to sign anything and most distos get given a signed shim that will only boot the turd called GRUB.