hm, i switched from debian based to fedora atomic and secureblue, because the graphene os dev pointed me there and the claims and properties check out and align with what i was looking for.
but i'll have to have a good look at kicksecure to have an opinion. i appreciate the suggestion :)