Netboot.xyz
No usb? no problem!
How To
If you boot from pxe, while connected to base lan (with ethernet), you will be presented with the netboot.xyz menu, allowing you to pick from pretty much every live iso or install iso available for linux operating systems. They will be downloaded directly from their respective mirrors if possible, with signature checking to ensure originality.
Implementation
In base LAN, on the proxmox cluster, there's a LXC container with a lightweight version of netboot.xyz. The dns+dhcp has a dnsmasq config snippet to auto detect what kind of machine is trying to PXE-boot on the network and supplies it the ip address of the netboot-xyz.at.base48.cz container, and a corresponding bootfile name (pxelinux.0 for bios, etc etc for other) auto-detecting x86/arm64 and bios/legacyboot. Secure boot should in theory work, but to be safe it's best to be disabled during the installation. The container can be administered by any council member, authenticated by their keycloak account to the proxmox cluster.