Would this not also be an issue for Windows users? Or is the Windows boot loader signed with a different key?

That’s ok you can finish it later

Are there any hardware manufacturers that aren’t completely shit at providing firmware updates? My motherboard does still get updates but they can take a while to arrive even when there’s a known exploit for my CPU which requires a firmware update to fix (made even worse by the fact that AMD are awful at providing fixes in the first place)

That makes sense. Would a signed initramfs be possible though? Since it’s usually rebuilt after most system updates?

If someone has physical access then surely they can change the initramfs without having to use the debug shell?