Embed Notice

@mstrohm I'm uncertain as to whether U-Boot supports UEFI's "SecureBoot" feature; I haven't tested it yet, but I will.

Libreboot has (since very early days) supported a feature that I call "Secure libreBoot", whereby GRUB is the primary payload (after coreboot init) or SeaBIOS doesn't load oproms and loads GRUB straight away, with the SeaBIOS menu disabled.

GRUB then requries a password, optional GPG check on your kernel, and full disk encryption including /boot.

See:

https://libreboot.org/docs/linux/grub_hardening.html