Their point was to not have fully encrypted drive, so it boots without a prompt
You can achieve this even with full disk encryption with Secure Boot and TPM. That’s how Bitlocker does it. I have this setup on my Desktop — One single root partition with LUKS, Secure Boot on with sbctl and cryptenroll for tpm unlocking. Takes less than 5 mins to setup.
Yes. Just encrypt /home partition only
This is dangerous. As some data like cache and logs are stored in the root partition. So some of your data from home partition might trickle up the root partition in that form.
why encrypt it in the first place?
My threat model doesn’t include someone gaining direct access to my home desktop. I have Arch Linux with Secure Boot and TPM 2.0 enabled on fully encrypted drive and this chain’s existence makes it easier to know that no one has tampered with my system. On my laptop I am one step further with requirement of BIOS password.
storing the encryption keys in TPM, but others say then you can lose your keys if the mobo dies
That doesn’t mean you can’t decrypt your drive. It is just that it won’t be automatically encrypted at boot.
They are shit