This is exactly how I boot my computer.
In Windows I:
- Insert write-protected VeraCrypt recovery USB stick into USB
- Boot and hit F12
- Select the stick as the device to boot from, when VeraCrypt's recovery appears, I select to boot from the stick's copy of the EFI bootloader.
- Enter my Windows VeraCrypt partition password, and only when that processes can the bootloader even see my Windows drive, which can't really be tampered with because it's encrypted.
In Windows, the EFI bootloader doesn't change except in major build-number updates. When it does, i update the EFI on my stick from a secure machine using verified EFI Windows boot binaries for that build. The Veracrypt bootloader EFI binaries only change if I update to a new version of Veracrypt, which after installation there is very rarely a need for.
In Linux I:
- Insert other write-protected EFI + /boot USB stick
- Boot and hit F12
- Select the stick as the device to boot from, boot into Grub which then chains into the initramfs on the stick's /boot
- Enter my Linux LUKS password, and continue to boot.
In Linux, once control has passed to initramfs, /boot is no longer needed, so it doesn't matter that it's not read/write. I have a script that I can use to remount /boot and /boot/efi as required if I want to do a kernel update. In that case, I flip the write-enable on my stick, insert it, mount /boot and /boot/efi, and do the kernel update. Unmount, stick out, write-disable, and then back in to use scripts that take the bootloader and first two partitions of the stick (the EFI and /boot) and images it for a backup, and takes an sha512sum of that and signs it with my GnuPG key. I can thus verify the integrity of the stick any time, verify the backup, and ensure they both match. The backup, its sha512sum and signature are all sent off machine to online storage.
In short, unless you get my USB sticks (which are on my keychain and go with me everywhere), you're not booting my computer into anything that I don't control. Even if someone got my sticks, I can replace them in a way that I can, with very high level of assurance, know is safe.