carbonOS should secure the boot chain and verify every bit of operating system code it loads at boot References: - [Blog post that prompts this](https://0pointer.net/blog/authenticated-boot-and-disk-encryption-on-linux.html) - [Arch Wiki: Secure Boot](https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot) - [systemd-stub](https://www.freedesktop.org/software/systemd/man/systemd-stub.html) - [Things to keep in mind when configuring LUKS](https://wiki.archlinux.org/title/Dm-crypt/Specialties)