The sdboot variant of this image uses systemd-boot as bootloader. On first boot the image encrypts itself and offers options to deploy a custom password or unlock via FIDO2 token or TPM2 chip.
The TPM2 support is heavily experimental and currently only binds to firmware, bootloader and kernel so it is not advisable to be used in production, just like the rest of the image :-)