The second part in the series deals with that by mounting it read-only from initrd.