What does shutting it off do? As far as I understand, they can still require a search. I had it happen once when entering Canada, they said if I didn't consent to the search they would confiscate my laptop. I let them search it, and obviously they didn't find anything incriminating, but it felt so violating watching them go through all my personal photos.

full disk encryption keys are not in memory yet

Does this mean they asked you to unlock it / decrypt it?

Yes. If I did not comply they would take the laptop and I would have to get a lawyer to try to get it back.

Be thankful they did not take a copy of your hdd for forensics later.

Maybe they did. Maybe the "search" is just covering the time it takes to run their cloning program. Let that fester ;-)

No. They did it in front of me and all they did was run a search for JPG and PNG images. Then they went through all of the pictures. They did not attach any hardware/cables to the computer and they did not connect it to a network.

That said, this was years ago. I have heard that they do try to clone the drive now.

In enhanced security checks in the EU, they often make you turn on your electronic devices.

can they force you to log in?

When this has happened to me, it's been about ensuring the device can turn on at all, they don't investigate what's on it.

with this concept of testing for actual electronic equipment vs nefarious object disguised as an electronic device my protections of shutdown still hold

Sure, but it's overkill. You'll have to turn it on anyway if you're selected.

Turning it on without logging in does not decrypt the FDE volume though. I'm only turning it off to ensure the decryption keys are not in memory. There's nothing on my laptop that would land me in trouble, but they're going to need a $5 wrench to get access. The day that happens, we'll know if it will need to be used, or if the mere presence of the wrench is enough

My approach is to replace the SecureBoot keys with one of my own signing, and sign my own bootloader. Have it boot into Windows unless a specific key combo is pressed, otherwise have it boot into Linux and require a password to decrypt the drive.

Plausible deniability and FDE (for the partition you care about at least).

Yes and if you refuse they confiscate the device.

Only time I was ever asked to login was in Morocco. It was an older agent and I assume he just wanted to make sure it wasn't a fake screen or something.

I didn't like it though.