[gentoo-user] New PC, new boot concepts

[Mick]

Old dogs and new tricks springs to mind.  I am building a new PC and what with 
UEFI, APUs and SSDs, it feels like that the world has moved a long way since 
the last time I had to install gentoo.

I'll be taking my time to google, read and make appropriate selections, so 
please bear with me while I start relevant threads as necessary to complement 
my sparse knowledge in these topics.  Starting from the top, with this thread 
I am trying to find out what is considered good practice as far as UEFI/MBR 
and boot management goes.

The MoBo is capable of booting in CMS mode, but I am not sure if there are any 
benefits in creating a 2MB partition for a conventional MBR bootloader, or I 
should forego MBR altogether and go directly with a GPT FAT32 EFI System 
Partition (ESP).

If the latter is the way to go and I forget all things I ever learned about 
MBR, does the 550MB FAT32 ESP partition have to be at the beginning of the 
drive?

Is it beneficial to install a Linux boot loader/manager like GRUB2, or rEFInd, 
etc., or should I just use the kernel EFI Boot Stub to boot gentoo with?  The 
PC will single boot in Gentoo, although I may drop in a sysrescuecd image for 
recovery purposes and would be nice to be able to boot this straight off the 
disk, without having to burn it on a CDROM.  Is it simply a matter of adding 
the LiveCD iso in the ESP with a .efi suffix, or will I need to use efibootmgr 
to inform the UEFI about *any* kernel images in the ESP other than the default 
EFI/BOOT/bootx64.efi?

Finally, what's your opinion on 'secure boot'?  I'm mostly thinking of its 
benefit as a pre-boot malware protection utility, but I don't want to 
introduce too much complexity which may make recovery of my data difficult in 
the future.  I've heard some horror stories resulting from NVRAM corruption, 
or flashing with new UEFI firmware rendering the PC unbootable, etc. but don't 
know if this is due to user error.  If you have experience using secure boot 
what is your preferred method?

Any other pointers and gotchas I should be careful with?

-- 
Regards,
Mick