Bit of a correction, grub.cfg is not touched during upgrades. In fact
since 522.x.x nothing in the ESP partition is modified during
upgrades, grub is configured to select the system to boot solely based
on GPT partition attributes and reads the kernel from the selected
partition, USR-A or USR-B. Prior to 522 the update process did copy
some configs and kernels around. This current situation may change
again in the future once we develop a scheme to safely upgrade the
bootloader but we don't have a way to do that right now. There is a
more formal hook point for customizing grub than directly modifying
the main grub.cfg in the ESP. If you look at that file you'll note
that early on it checks for a grub.cfg in the OEM partition to load
extra configuration from. We use this for platforms that need to
switch the default console or other kernel args. For example:
https://github.com/coreos/coreos-overlay/blob/master/coreos-base/oem-gce/files/grub.cfg
The main grub.cfg lives here:
https://github.com/coreos/scripts/blob/master/build_library/grub.cfg
As is our images do boot on Xen PV and Xen HVM+seabios. I have not yet
done any testing with Xen HVM+UEFI which is a pretty new feature, we
do work fine on normal UEFI systems though. If by 'bare metal' you
mean you are trying to boot CoreOS as a dom0 instance, that we don't
do out of the box right now but I've done in special testing images
that used this OEM grub.cfg:
https://github.com/coreos/coreos-overlay/blob/master/coreos-base/oem-xendom0/files/grub.cfg
As for tboot, we have some testing with secure/verified boot in CoreOS
but we are still in early stages of implementing all of the parts
required to have a fully verified system. I would be very curious what
your use case is. :)