Need a source on this one, I want to read up on this.

Yes, it breaks native login, but you can authenticate with Authentik on your phone for example, and use Quick connect to authorize non-browser sessions with it.

NovaCustom: Coreboot, Linux support, customizable, spare parts.

I have no personal experience, but their products seem nice, though expensive.

https://novacustom.com/