this is, like, partly why I insist on disk encryption because *physical* security is the one thing I have any realistic influence over in lieu of running a hardened kernel that is a glorified hypervisor that orchestrates dozens of jailed processes to recreate a "standard desktop environment" lol

like this is still a hilarious delusion in the sense that i'm hoping a sufficiently motivated state actor doesn't have a zero day by way of firmware and UEFI, my literal fucking processor's microcode, or just a plain bug in systemd-boot but... those caveats are TINY compared to the desktop lol