If you’re going for secure boot, I’d advise against GRUB.
Use an UKI, dm-verity and get one part of your disk encryption key from your TPM 2.0 (choose PCRs carefully). Is that not compatible with timeshift?
Also see safeboot.dev, even if that’s just for Ubuntu 20.04.