I understand why this is a problem, or would be on systems where much of the initial stages of the system are left unencrypted. But because literally everything but grubx64.efi is encrypted, there is no need for them to be verified. Only grub, which asks for my password for the decrypting, needs to be verified. This behavior is intended for systems that require more security, for example, to prevent unauthorized loading of drivers by a malicious attacker. But I don’t need or want that.
Sounds like cope to me. You don’t get to tell an attacker which component they can attack when you have misconfigured your security guards.
Oh no, if only you had a setup where you could instantly reboot into an older kernel, with one click.
I keep the LTS kernel around for that. It’s a “one-click solution” for boot problems. And anyway, a simple chroot should allow me to fix any problems.
Don’t see what advantage snapper rollbacks have for me when I would need to use it rarely. I don’t have a habit of intentionally breaking things. And when things break on me (I use Arch btw), they rarely introduce fatal errors.