Actually, I setup secure boot, it isnt that much of a pain. If the docs were more clear, it’s like a nice 4-7 commands, with some reboots (clarity missing in arch wiki)

TBH, Epic Games EACv2 looks decently well designed, and robust:

Requirements:

1. Signed Kernel & Kernel Modules
2. TPM 2.0
3. Secure Boot
4. Measured Boot
5. Input-Output Memory Management Unit (IOMMU)
6. Kernel Lockdown Integrity Mode
7. Kexec Disabled
8. Linux Security Module BPF

• systemd service (with hopefully introspectable code) which all it does is checks the above and gives a verified bool (also locks memory regions for Epic games)

Generally it is a good system of locking down any potential paths for code that can work on other processes’ memory.

Signed boot kernel is big problem for most distros (though most people don’t modify their ramdisk, or cmdline, so… probably fine?). Kernel modules would be iffy too, I guess, but presumable even for Arch it would mean .ko from only the official repos. The others are just annoyances.

Would not be a huge amount of pain to set this up for distros. Definitely political momentum is not there and I think will never be. Linux is just a different beast and won’t bend to their corporational “Lock it down!” mentality, better find other ways to combat cheating.