Hacker News Reader

Chances are theres an EFI partition thats still unencrypted, too! This is where secureboot/tboot has its chance to shine.

View on HN

Indeed. LUKS key on tpm2 with secure boot with /boot on encrypted seems anything but easy to setup. I also complicate things by making everything apart from efi on zfs.

Reply on news.ycombinator.com