The kernel isn't able to determine whether you booted in a verifiable manner in all cases, so there's functionality that allows the bootloader to make that deci

The kernel isn't able to determine whether you booted in a verifiable manner in all cases, so there's functionality that allows the bootloader to make that decision rather than the kernel. But if you don't have a verified boot environment and someone is deliberately attacking you, it's easy for them to fake up your early boot environment such that the kernel believes it's booted securely even if it hasn't been. If you want to protect against accidents then you can do that in userspace. There's no need for the kernel to be involved.