spyke on Nostr: When a new unikernel is installed, the previous one remains on the EFI partition, so ...

When a new unikernel is installed, the previous one remains on the EFI partition, so to recover from a broken kernel you just open the EFI boot manager and choose another boot option. Regular users do not tweak kernel parameters. Not sure what you mean by password resets. But the OS itself in not encrypted, so any tools could even have good UI. For mode advanced recovery procedures use a recovery partition like on Windows PC. Elementary OS team was looking into this.