TFW you discover that the #Linux distro with "Secure" in its tagline ships with integrity policy enforcement (CONFIG_SECURITY_IPE) disabled. IPE is a royal PITA, but naively, this feels like finding a secure variant of macOS shipping with Gatekeeper not just disabled, but impossible to enable.