Also, LUKS root partition encryption with TPM2.0 auto-unlocking and direct EFI secure boot is also a thing!
Here's how I got it all setup and working!

todo- use other arch linux logo