Windows is signed with different keys to all other third party UEFI code, so in theory you could ship a system that trusted Windows but not anything else. "Anyt

Windows is signed with different keys to all other third party UEFI code, so in theory you could ship a system that trusted Windows but not anything else. "Anything else" would include the option ROMs on GPUs, so you'd never be able to plug in a new Nvidia, but if that's a price you're willing to pay you could definitely block Linux today.