I expect this to take a couple weeks before I flesh everything out, but I am already putting the PR here if someone wants to play around with it. My current setup with this:

1. First, an EL2 specialization, with the devicetree overlay and extra kernel param needed:

specialisation.el2.configuration = {
  hardware.deviceTree.overlays = [{
    name = "x1e-el2";
    dtboFile = "${pkgs.slbounce}/dtbo/x1e-el2.dtbo";
  }];

  boot.kernelParams = [ "id_aa64mmfr0.ecv=1" ];
};

2. Manually copy slbounce.efi to /EFI/systemd/drivers/slbounceaa64.efi on the ESP.
3. Copy tcblaunch.exe (from C:\Windows\System32\tcblaunch.exe) to the root of the ESP.

Reviewed