tc security environment boot code - more broadly based?

[bigpcman]

I have been thinking about the notion of nomadic vs vulnerability in usb housed systems. I like the idea of the root and user passwords and encrypted backup files. So I wonder if it makes sense to have a more broadly based secure bootcode that establishes persistent root and user passwords, hardens the sudoer file a bit and uses encryption for the backup file. Any thoughts?

[tobiaus]

i like everything you said except the idea of lumping in encryption. that should not happen by default, it should have its own boot option, not be a feature of a boot option. if you want to keep it simple, call it "enc" or something.

also it would be annoying if you could not sudo su. just ask for the root password before allowing it.