I didn’t realize people were talking about self hosted. For public NetBoot.xyz: Even if they deliver isos matching publicly available checksums, you can’t trust they won’t inject kernel parameters unwittingly. If I was a cyber criminal I would find NetBoot.xyz a fine place to build out a bot net.