@brauner Just make it EFI variable, OS should load only presented with valid ID via camera. We can go full James Bond on this.