[LWIRVoltage]

This is something no on discusses but I've wondered heavily- GRUB can be made to not show a menu and then boot up Windows automatically, in like a second or two with no one the wiser. [There is an obnoxious welcome to grub message that pops up now but I see a public project out there that solves this very easily called GRUB shusher]

I don't know if other bootloaders outside GRUB have a silent/hidden start option, as well in a similar vein that would require you to hit a key in that first second to get the menu to appear, or else it just boots up normally

I wonder about the other approach, just going into the BIOS nad changing the order so Windows boots first, which should be doable in some setups. Lock the BIOS with a password, and you're in not bad shape. (Not sure if Secure Boot being enabled could also help here - probably couldn't hurt)

[aftbit]

My approach would be to rename the Grub EFI image to something silly like "HP Windows Recovery", then set Windows to boot first. Someone could smash F11 then select the recovery option to make sure it was really recovery... but the average Keystone Kop at CBP would probably not figure this out. In fact, I think they would just turn the machine on, see it start to boot Windows, shrug, and turn it off again. If they image the machine, they can find that it has Linux with forensics, but I really struggle to imagine anyone caring enough to chase me down after the fact.

I am a US citizen though. The only real goal for me at CBP is to avoid secondary at all. I'm not worried at all about them coming for me after I leave the airport. If that sort of stuff starts to happen... I am screwed anyway. They can find records of everything I've said by just compelling US companies to disclose it to them.

[reassess_blind]

Any examples of the silent GRUB setup? Sounds interesting.

I left a comment about Veracrypt offering the Hidden OS feature, with two passwords - one for the dummy OS and one for the real OS. However it doesn't seem to be supported anymore on Windows 11 or modern hardware, the option is greyed out on my laptop with no explanation.