+ secure split of rootfs (RO) and home (RW)