This reminds me of netbooting workflows from things like MaaS, Tinkerbell, and Dan's old Plunder tool.

They'd netboot.. not mount the disks, then download an ISO/IMG and write it directly to the primary boot disk.

If netbooting is a heavy lift, why not boot into a custom initramfs you built, with i.e. dd/curl installed, and flash the disk that way, without mounting / at all? Then kexec/chroot into it?

I'd much prefer this as a way to provision Raspberry Pis.

Part 2 presents a fully automated proof of concept that does all of this: https://astrid.tech/2026/03/24/2/how-to-pass-secrets-between...