groche

UKIs are good for secureboot/measureboot, because you can sign the uki, and everything inside of it be validated for secureboot. If you really like to have a secure chain without a uki, you need to validate all the boot components. You can do it with grub and gpg signatures, but is more simple to use an uki and a efi bootloader like systemd-boot

afro samurai is a masterpiece

But you want to use systemd-boot? Obviously you need to install systems-utils if you want to install systemd-boot, but you can use grub or something else bootloader

You can install gentoo-kernel-bin and everything works fine. About SystemD, you needn’t systemd as init, but you need systemd as udev or other things. Only follow the guide with a non-systemd profile

Nowadays a lot of hardware works very well on Linux, the main approach of this vendors is not the compatibility (has guaranteed but as you say in a thinkpad you have the same compatibility), the approach is about a free software (or mostly free) firmware, and in this case, free and secure implementation for the firmware an all secureboor chain