

Sorry but this whole thing is just snake-oil.
You can verify and sign your whole trust chain down to the last shared library and it doesn’t matter when you don’t know what the binary blobs on your TPM / CPU / BIOS / NIC are doing.
The only guarantee to a secure system is openness an all of that signing won’t help you there.


Bunkers only are useful if there is friendly territory behind them.
If you can’t call the police or your local warlord it’s a prison in the best case and an expensive tomb in the worst case.