[rcxdude]

This code already exists in UEFI in the form of secure boot. The 'bootloader' (more accurately 'boot menu' IMO) kernel and its initramfs would be authenticated and unlocked by the system firmware, and then authenticate and unlock the rootfs and (optionally) different kernel for that system. It's basically going "hey, GRUB is more or less re-inventing the linux kernel, why don't we just write a simple userland for linux that does the same job but with way less code instead?"

[BobbyTables2]

Actually I don’t think UEFI firmware validates the initramfs — that is loaded by the kernel’s efi stub.

One can make a UKI image which glues the two together in a single file along with a tiny bit of code for booting it.