As the wiki says, you can set a password for grub. Moreover, it seems to be possible to encrypt /boot. Moreover, I hear that bootloader can be made secure boot. Which method is the best way to focus on security and privacy?I'd also like to see the differences explained, if possible. t's a laptop.professional level protection against industrial espionage, or government secrets cuz I'd like to protect it at this level because there's so much seizure and state surveillance on interstate travel these days.
If the hacker has (had) physical access to your system, you're f-ed regardless (think of hardware backdoors, changed bootloader, etc.). If you just want to protect your data from possible prying eyes, having a non-encrypted /boot will save you from a lot of unnecessary hassle.
My /boot and EFI system partitions are not encrypted but everything else is.