Installing Parabola or Arch GNU+Linux-Libre, with Full-Disk Encryption (including /boot)
https://libreboot.org/docs/gnulinux/encrypted_parabola.html
Installing Trisquel GNU+Linux with Full-Disk Encryption (including /boot)
https://libreboot.org/docs/gnulinux/encrypted_trisquel.html
https://libreboot.org/docs/gnulinux/grub_hardening.html
https://www.coreboot.org/Security
http://git.savannah.gnu.org/cgit/grub.git/tree/docs/grub.cfg