@civodul I use a custom bootloader procedure that copies all files referenced by the GRUB configuration from the store to /boot. Allowing me to use an unencrypted /boot with Guix and performing decryption of / once from the initramfs: https://notes.8pit.net/notes/mwpp.html
That has worked out quite well for me personally. From a security perspective, I don't see much downsides as an attacker with physical access may as well compromise GRUB (instead of vmlinuz).


