groche

UKIs are good for secureboot/measureboot, because you can sign the uki, and everything inside of it be validated for secureboot. If you really like to have a secure chain without a uki, you need to validate all the boot components. You can do it with grub and gpg signatures, but is more simple to use an uki and a efi bootloader like systemd-boot

Gentoo have both sides, the cool community and the suckless community xD You can check it in the telegram groups about gentoo