In order to protect a fully encrypted system I want to put the boot partition on a CD-ROM, so it cannot be altered. In my scenario an USB stick is too insecure and not possible. I read that I might get problems with kernel upgrades. How serious is that problem? Would there be another kernel on the fully encrypted system, too? Would the kernel on the CD-ROM just be used for booting? I'm new to linux.