... your bootloader for a signed hash of itself and verify that the signature of the hash ...
... Now, give the bootloader the power to suspend any running operating system to disk, encrypting ...