This tutorial covers using NetworkManager with either wpa_supplicant or IWD backend. If you did not heard of IWD, it is propbable your NetworkManager uses wpa_supplicant.
UW authorization server uses DSK-NET CA certificate that is self-signed, so we need to specify it manually.
curl https://it.uw.edu.pl/pl/uslugi/UslugiInternetWiFiEduroam/dsk_net_ca.crt | sudo tee /etc/dsk_net_ca.crt
This guide provides instructions for an Arch Linux installation featuring full-disk encryption via LVM on LUKS and an encrypted boot partition (GRUB) for UEFI systems.
Following the main installation are further instructions to harden against Evil Maid attacks via UEFI Secure Boot custom key enrollment and self-signed kernel and bootloader.
You will find most of this information pulled from the Arch Wiki and other resources linked thereof.
Note: The system was installed on an NVMe SSD, substitute /dev/nvme0nX with /dev/sdX or your device as needed.