Pretty late here, but is there any security-related reason to prefer a uki over a signed grub efi executable and encrypted /boot? I know I won't have multiple grub binaries but I will have multiple kernels, and generating UKIs, signing them, and making sure the efi partition is big enough is a bit of a pain.