ubuntu 26.10 release article mentions widening support for systems without compatible hardware for secure boot and full disk encryption. This model uses
UEFI
Secure boot
UKI
signed kernels and initrd from canonical
tpm
I don't see how they are going to make this work as many packages rebuild initrd upon installation. What could work is to have the signed kernel sign the new initrd i guess but that still seems unlikely. UKI is one image that combines both initrd and kernel. To allow everything to work the initrd would have to include every possible package but that still would not allow any custom workflow that is needed. This would only work for stock settings. Since the luks2 device is passed from grub I am assuming that grub is setup first before the tpm2 handshake with the hashing of the grub.
AI tells me that it is not possible to use canonicals FDE+tpm with any customizations. In this case it would be very helpful for canonical to include my extensions to initramfs which supporting booting encrypted luks root volumes without adding files to initrd. Some of my workflow still modify the initrd but i plan to remove that requirement.