sbctl is recommended these days: https://github.com/nix-community/lanzaboote/blob/master/docs...