I am aware secure boot doesn’t require a TPM, but I’ve always been confused by its purpose since it’s trivial to disable. Makes sense if you use it in conjunction with TPM measurements. I personally encrypt all my filesystems except my /boot which is also my ESP, I use the efistub and that’s good enough for loss of device. For a physical attacker with actual skills I’m SOL, it’s not that I don’t want to protect against it, I just couldn’t figure out a reliable way to.
I’m so excited for this!!