I really wish building minimal, custom kernels was easier. NixOS makes it somewhat sane but it's still a mess of custom kconfig, defconfig target hacking, and manually splicing out the necessary firmware and kernel modules. The kernel doesn't even have an interface to show what firmware blobs have been loaded. You can do some firmware signature enforcement but I guess no one cares about random binary blobs are running just to work your laptop webcam.

It would be very useful if I could just boot a kernel and get an instant report of what kernel config, firmware and modules are actually used/needed. You can kind of do this but

> Blacklisted the hardware a KVM guest never has or doesn't need

I'm a little surprised that matters; shouldn't Linux be lazy loading drivers only when it sees hardware?