Speaking of SecureBoot and how practically no Linux distribution actually makes use of its potential (in terms of increasing security), does anyone here have any experience with SafeBoot?[0] It looked pretty interesting to me, though mounting the rootfs read-only didn't seem go well with how most Linux distributions these days still require you to change files in / on an almost daily basis.
> [...] how practically no Linux distribution actually makes use of its potential (in terms of increasing security) [...]
FWIW, I double-checked with a Fedora developer; the above statement is incorrect. Fedora uses it (Secure Boot) to enforce lock-down on the kernel and then require code signing, etc.
I'm pretty sure both Ubuntu and Fedora installers display and have the option for MOK enrollment, when you have SB enabled and you select ~"Install additional drivers", meaning you can install your own modules.
[0]: https://safeboot.dev