I have often considered making a set of scripts to do just exactly this (after disabling the SSV so that the system can be modified).

It would be no less secure than any modern or common linux OS, which do not use a read only signed root.