and I imagine that the initramfs is not encrypted and trivially modifiable?

Apple is able to achieve this securely because their devices are not fully encrypted. They can authenticate/sign the unencrypted system partition.

You auth the initrd too

	▲	conradev 4 days ago \| parent [-]
		This is super cool, thanks for the link! I’m glad they were able to leverage the TPM