[the8472]

If you're concerned about an evil maid attack then you can authenticate bootloader, initramfs and kernel via secure boot.