"But Elly what if the firmware is compromised" My sibling in Christ, if my firmware, CPU microcode, TPM, boot chain, and kernel threat model are all fucked, I have gone from "laptop security problem" to "a nation-state has taken a personal interest in me." Which is a much worse problem to have. "I want my disk/credential secrets released ONLY when this machine boots software I specifically authorised" is an extremely reasonable and rational thing to want from a laptop. You know. The computer specifically designed to be taken with me whilst containing my entire digital life and can be stolen at any time.