It once occurred to me that it&#x27;s possible to encrypt the disk completely and put bootloader&#x2F;kernel&#x2F;etc on a flash drive attached to your keyring (the physical kind).<p>Then it all boils down to BIOS security. With physical WP pins on flash chips it ought to be possible to make BIOS reflashing a reasonable PITA, especially for someone who wasn&#x27;t prepared for such surprise.