TPM has solved this now for decades.

Verified boot + TPM encryption key storage is a huge layer of protection for the boot process.