Debian provides a lot of the pieces you need to create a securely booting Linux system that is able to encrypt all its sensitive data while storing the key in a device-bound trust anchor like a TPM. It even permits to use immutable rootfs images that can be updated in A/B fashion atomically. But all these pieces are neither plugged together by its official installer nor would that help when you need offline-built and signed images.