&gt; You can even trust the hard drive if you use software encryption of all your data.<p>Hard drive replaces your GRUB payload with a compromised one that records your encryption key. You lose.<p>You could put your bootloader and &#x2F;boot on a USB stick, but then you&#x27;re putting the same trust in the stick.<p>Unfortunately, hardware security is <i>really difficult</i> if your threat model does not assume your vendors are trusted. In fact, I don&#x27;t think it&#x27;s actually possible today to get verifiably trustworthy hardware under that threat model.