> How hard would it be to boot a signed kernel with a system ready to give you all the access you want or need?

Depends on the config. From trivial (old BIOS, no protection) to ~impossible (locked uefi doing secure boot).

> once i could copy your encrypted key i could likely use it right away with TPM

You cannot copy the key once it's moved into the TPM chip.

> Don't you look out for someone snooping on your typing when you enter passphrases?

No. I'm not secure from targeted snooping anyway, but I'm not typing any non-local passwords usable by people reviewing old camera footage - in most cases access is being 2fa.