Apple Silicon supports local signing of whatever boot blob you like from in the recovery environment (in Permissive Security mode). This ensures the system boot

Apple Silicon supports local signing of whatever boot blob you like from in the recovery environment (in Permissive Security mode). This ensures the system boots the bits you yourself approved without applying any other requirements. The other policies available are a) verify at install time the boot kernel is signed by Apple and is the most currently available version (default) or b) to verify at install time the boot kernel is signed by Apple without doing an online check (allows downgrades). In all cases it's the same underlying mechanism that records what the system should be allowed to boot (according to whatever policy is in effect) and verifies at boot time it hasn't been tampered with. Big Sur takes that further and cryptographically verifies the entire system volume hasn't been tampered with (even offline). You are correct that Apple does not provide drivers for other operating systems for M1 Macs.