Start move to /boot kernel mount x-os: prepare booting from unencrypted /boot partition Move to systemd-boot Remove all unencrypted secrets