They are stored behind luks and I think they are readable only by root. But bootkit can probably only infect UEFI from Linux that is running on that machine. And to interact to UEFI you probably have to be root, right?
I’ll look into more options, either store keys on a seperate luks usb key or on a hardware securety key like Nitrokey. For sbctl
there is already a roadmap feature for hardware security keys, I hope this comes soon :)
I’m 100% sure that Raspberry Pi has that. I can set how much of ram will go for the gpu. But raspberry pi’s gpu isn’t really a gpu.