Secure Boot and LUKS-encrypted rootfs on Raspberry Pi CM4

Hello all

I have an A/B system running on a Raspberry Pi CM4 using the tryboot_a_b mode from the Raspberry Pi Firmware (via the https://github.com/agherzan/meta-raspberrypi layer).

I’m now exploring how to implement Secure Boot using the Raspberry Pi Firmware (without U-Boot) and have run into a few design challenges:
- The files on the boot partition (cmdline.txt, config.txt, kernel8.img, initramfs etc.) need to be packed into a boot.img file using the Raspberry Pi script https://github.com/raspberrypi/usbboot/blob/master/tools/rpi-make-boot-image. I believe this could be integrated with a .bbclass file.
- The resulting boot.img file then needs to be signed using https://github.com/raspberrypi/rpi-eeprom/blob/master/rpi-eeprom-digest, which could also be handled through a .bbclass file.
- Both rootfs partitions (A/B) should be LUKS-encrypted, unlocked during boot via an initramfs. This seems like the biggest challenge, I'm not sure if this is even possible with WIC, especially because the key for the partition needs to be device-specific.

Has anyone worked on something similar, or have pointers on how to best approach this?

Thanks

Benjamin