I was thinking essentially about Linux equivalent of PEP.

Of course my preferred setup would be for systems to actually ship compliant UEFI instead of Qualcomm shitshow