Really interested on seeing this, although if I could make a suggestion, start by scouting around and see if you can adapt FOSS apps, maybe fork them and add/remove features to please your objectives and tastes.

Although I’m eager to see these through, I like projects like murena (/e/OS) that cobble together good Foss projects into a single cohesive ecosystem (without making the word ecosystem gross and vendor locked in like in most cases)

Cut them some slack?! They’ve got all the slack already!

Even if ubi were doing fine I doubt we’d ever seen it, and if we ever so, I expect another DNF case

And Beyond Good and Evil 2

Unless the crook happens to be extremely nerdy or its law enforcement, already being a Linux formatted partition feels it should be enough for a rando breaking in and stealing a computer.

That being said, something like a PiKVM connected to your server (and Tailscale) could let you enable both UEFI/boot password and propt for LUKS decryption upon boot.