A signed UEFI Secure Boot rescue environment that lets operators pick any ISO from a USB stick's data partition and kexec into it — without leaving the chain of trust.