[pzmarzly]

This is already possible with kernel patches in https://github.com/osresearch/safeboot-loader . It is extremely cool, but the README there also explains why it's not necessarily a good idea.