

That’s precisely why secure boot and TPMs exist - the TPM can store the keys to decrypt the drives and won’t give them unless the signed shim executable can be verified; the shim executable then checks the kernel images, options, and DKMS drivers’ signatures as well. If the boot partition has been tampered with, the drive won’t decrypt except by manual override.
The big problem is Microsoft controls the main secure boot certificate authority, rather than a standards body. This means that either a bad actor stealing the key or Microsoft itself could use a signed malicious binary used to exploit systems.
Still, it’s at least useful against petty theft.
TPM sniffing attacks seem possible, but it looks like the kernel uses parameter and session encryption by default to mitigate that: https://docs.kernel.org/security/tpm/tpm-security.html












The Arch Wiki is probably the sungle most useful documentation for any Linux user; I don’t even use Arch and it’s still extremely helpful.
I could see the benefits of using Arch just so almost every function my system has is near-perfectly documented in Arch Wiki.
As for the distro itself, it has the newest packages, and often good repos with interesting packages that Debian and others may lack. It also expects you to choose and install the components you want, whereas the Debian installer will usually just install defaults; you can use Debootstrap for a minimal Debian install, but that’s not as well supported for installing Debian due to the way tools as set up on the install medium.
The reason I choose Debian over Arch is because if I don’t use a device for several months and have to install updates (like my school laptop over the summer), Debian Stable is more likely to survive that than Arch; I’ve destroyed several Arch VMs by trying to update them after not using them for months. I’m sure I could have salvaged them if I tried, but I’d rather just make a new VM.