It is fairly easy to accomplish on Manjaro as well.
Or if you want to get real dirty - creating a unified kernel, sign it, enroll into secure boot.
Hint: sbctl is in the repo
I prefer to name it verifed boot - as it is only as secure as the user makes it 