I don't understand what kind of problem/threat secure boot solves. Is that something useful to end users, or more of a corporative measure to protect their hardware running in untrusted environments?

As I understand it, it's Microsofts attempt to only allow booting kernels signed by them or their partners. In theory this stops malicious attacks from changing the kernel and have it booted. But Secure Boot is just something you can turn off.

Not only that, earlier this year, it was discovered that there was a flaw in Secure Boot that meant it never even did the one thing it was supposed to do. This update is designed to make it functional for the first time.

As far as I can understand, only /boot has to be on a fat/ext4/iso9660 partition (apart from efi which has to be on a fat by itself). As efi is mounted on /boot/efi, I figure we'll need 2 separate partitions besides / (and whatever other partitions we might want to separate / into).

I start to worry that more and more of the system has to be uncovered to an attacker: if you keep the distro's kernel, it'll be easy to figure out the system installed on / so 90% of the data on disk will be known. No need for luks except for /home.

Is there a way to have whole disk encryption on linux and secure boot at the same time? efi already has to be unencrypted right? Now /boot...

Can systemd-boot save the day?