Per paragaph five: if the attacker already has root, the worst threats are already live. Preventing the pwned root account from altering future sessions is, to me, a very minor concern. The largest threats for end users being full access to data, keystrokes, and hardware. And servers probably aren't asking for hibernation. So then, blocking hibernation for desktop users for this attack vector alone doesn't make sense (yet).

If encrypted swap is still a no-go, what about a swap file within encrypted / ? Does that allow secure boot?