Secure Boot also works with Linux, no self-enrolled keys required for poular distros.

TPM measured boot is supported, but it’s a bit fussy to set up using traditional Linux boot, because the firmware, kernel, kernel command line, initrd, grub executable, grub environment, and the complete sequence of grub commands all need to be measured, and some of these things can change for valid reasons other than the obvious case of system updates or reconfiguration (e.g., the Red Hat grub-boot-success mechanism which sets a grub environment variable 2 minutes after a successful boot, so a reboot during or shortly after boot is enough to make measurements taken with this variable set fail).

Also, as in any auto-unlock scenario, the boot process all the way to the login prompt needs to be secured against any interruption that may enable the user to get unauthenticated system access after the disk is unlocked.