

My point was that it’s not EDK2 instead of GRUB at the same layer: EDK2 is the UEFI layer, and GRUB still runs fine on top of it as an EFI binary from your ESP. All the things you listed keep working that way: LUKS, RAID, password protection, even memtest via the efi/ insert mechanism. What you lose is only having GRUB directly in CBFS without an ESP.
What you gain with EDK2: Windows boots at all, TPM 2.0 works (the SeaBIOS issues that got it disabled are gone), and option ROMs for external GPUs.




You can configure EDK2 very restrictive, But you then have to compile libreboot by yourself with these options.E.g Ignore extern media, you can configure keys in the flash so it only can boot your grub binary from ESP. With tinkering you can make edk2 + uki (using systemd-cryptroll with measured boot etc) more secure than grub.
As far as I know there is no real standard api for TPM2, it is part of coreboot, but EDK2 has a standardized UEFI interface.