vodozemac might become that proven implementation. Without reinventing the wheel there will never be an alternative, because everyone just reuses the one existing library.
Currently, cloudstrike offers two methods for Linux: a kernel driver / module and a theoretically safer alternative using epbf (you could call that "kernel level scripting"). Ironically, they triggered a kernel bug using that second option. They did not test all kernels they listed as compatible or something like that.
Which is only available for a limited set of devices, does not have root, locks the bootloader again and is probably professional enough to get banks to approve their signing key.
For those reasons it is nor a viable solution for everyone.
For Linux maybe timekpr-next and some custom scripts to sync the time with the time limit server?