I'm surprised that the author doesn't mention Pureboot [0] or even Heads [1], the most user-friendly [2] way to use TPM on Linux and authenticate the boot process along with /root, /boot directories.

Also, there is no Microsoft involved in my laptop, i.e., the author's statement

> Microsoft's certificates are basically built into all of today's PCs

is wrong. I enjoy the coreboot with Heads on my Librem 14 with my own keys.

[0] https://docs.puri.sm/PureBoot.html

[1] https://github.com/osresearch/heads

[2] https://puri.sm/posts/pureboot-101-first-boot-first-update-a...