> What ensures that the hibernation image was actually written out by the kernel? Absolutely nothing, which means a motivated attacker with root access could turn off swap, write a hibernation image to the swap partition themselves, and then reboot
Maybe I'm just really thick, but I can't think of a reason to care that root could bypass secure boot. The attacker already has access to the entire system and I would usually assume the valuable part of that access is the data and not the hardware or the kernel. This is an attack at a level beyond the typical "evil maid" with physical level access.
Besides that, I'm not sure what would stop anyone from just tampering with pacman, mkinitcpio, or other things and just wait until the next kernel is being built and redeployed to have their fun. You're going to have to upgrade your kernel at some point, and you'll need some kind of tools to do so.
There's probably a very thin line between the threat that secure boot protects against and someone beating me to death for my password.