Nobody on the Linux side is opposed to TPM, Secure Boot and everything like that. The controversy is about who controls the key. Apple can either create a spec

Nobody on the Linux side is opposed to TPM, Secure Boot and everything like that. The controversy is about who controls the key. Apple can either create a special update key for the TrustedZone and distribute it to User (SmartCard in the package you buy the phone in) or they could just put in a non-upgradable system. Both would work.