Lanzaboote brings UEFI Secure Boot and Measured Boot to NixOS, providing the lzbt signing and UKI tooling plus a stub to harden the boot chain.