[londons_explore]

Perhaps it's time to move towards the Android/iOS model of having the OS unencrypted (since that isn't a secret anyway), and only do encryption of all the user data and apps.

That way, the OS can get to the login prompt entirely without secret data.

Obviously that's a big architecture change...

[yjftsjthsd-h]

At a bare minimum you still need to sign the OS in order to prevent tampering.

[sekh60]

How would one guarantee the integrity of the OS?

[als0]

Secure boot.