No Rescue Mode

[nurmagoz]

Hardware-backed Full Disk Encryption (FDE)

Encryption keys are stored in hardware (like a TPM or otherwise), meaning even if the disk is removed, it cannot be decrypted without the original device.

Boot Device Lockdown

It shall not be possible to boot any other operating system besides the one installed on the internal.

Bootloader Lock / Locked Bootloader

Prevents flashing or booting of alternative OSes. User controlled, Sovereign Boot: Yes.