AudaciousArmadillo

I remember them having this in the docs in the past, recommending a reinstall instead. But it seems that is no longer the case.

Same goes for .debs from Debian stable. There is no absolute safety. But downloading unsigned code from a random website is far down the safe list.

In the comments they clarify that is mostly targeted at servers and IoT first. In the enterprise world attestation is absolutely needed. And on personal devices? I’d be very happy if I had a secure boot chain for full disk encryption working out of the box. At least for portable devices…