This is what a TPM is designed to prevent, but they’re not very popular in Linux community.