I have secure boot, hibernation, and full disk encryption working fine on linux, but I have never heard of kernel lockdown.

The solution I found involves making a custom initramfs to support hibernation and compiling the kernel into a signed EFI stub.

Does the system use a boot loader? Or does it boot directly into kernel bypassing bootloaders?

	▲	Borealid an hour ago \| parent \| next [-]
		The term to search for is "UKI". A UKI is a kernel+initramfs+boot-arguments bundle all as a single WinPE/UEFI executable using the "EFI Stub Loader". You configure your system firmware to execute it, passing no arguments. It boots using the command line you set earlier. It's signed, and verified by the platform secure boot. Hibernation works fine with this approach.
	▲	beeflet 2 hours ago \| parent \| prev \| next [-]
		It boots directly into the kernel without a bootloader. You can specify built-in command line options when you're compiling the kernel. To dual-boot, I boot from a removable USB drive on my keychain. When it's not plugged in, it boots windows instead.
	▲	heavyset_go an hour ago \| parent \| prev [-]
		You can do both.