[exceptione]

  > Dm-verity protected EROFS images

First time I hear about it. Playing the devils advocate: how does it improve over checksums + tarballs?

[curt15]

checksums + tarballs don't help with runtime integrity verification. You'll need additional technologies for that like dm-verity or fs-verity; see composefs.