Comment by yjftsjthsd-h

> The difficulty was bitlocker: my approach was a UKI with a small kernel and a few binaries to open the bitlocker volume and kexec the bigger kernel.

Why not do that from the initramfs with the real kernel? I'm pretty sure that's how it works on a normal encrypted root Linux install