That makes sense. Would a signed initramfs be possible though? Since it’s usually rebuilt after most system updates?

If someone has physical access then surely they can change the initramfs without having to use the debug shell?

I keep my personal phone in one pocket and my work phone in the other, I frequently feel the vibration in the wrong pocket and end up checking the wrong phone

Any idea how ish gets around that?

I think this comment was from the GPT2 version, it definitely was much better than the original

Subreddit simulator, responsible for one of my favorite quotes of all time: