Have you ever seen a working configuration? The only other distro that advertises it out of the box is Fedora. And maybe it is better in this respect than Ubuntu, but I already wasted a few days dealing with the fallout, so maybe I'll try it next year.
Manual - maybe. But is spending time learning yet another distro worth the Windows license?
re: malware/backdoored
I am not running self-wafered CPU, so backdoors at certain levels are outside of the threat model.
If anything, Ubuntu was "malware" in the sense that it didn't work as advertised. https://documentation.ubuntu.com/core/how-to-guides/manage-u...
> After entering a valid key, Ubuntu Core will decrypt the device, proceed with the boot, and restore the TPM from the recovered key. The recovery keys will remain the same and do not need to be retrieved again.
The restore TPM bit just didn't happen.