[jburgess777]

If you want to avoid the initrd loophole then you will want to look into UKI images. These extend the secure boot signature to include the kernel and ramdisk:

https://uapi-group.org/specifications/specs/unified_kernel_i...