Two projects that are interesting and relevant work to address portions of this space are safeboot (https://safeboot.dev/) and heads (https://osresearch.net/).