I base this upon what I read in OP. From OP: > You do have to click through Apple's EULA in order to use the machines at all. > Owner control is asserted on f

I base this upon what I read in OP. From OP: > You do have to click through Apple's EULA in order to use the machines at all. > Owner control is asserted on first boot (you become machine owner by going through the macOS setup flow and creating the first admin user). > The SEP maintains a database of machine owner users. The first such user is created when the user goes through the macOS boot flow on first startup from a factory-fresh state (or after a full DFU wipe). Subsequent machine owners can only be created by authenticating with an existing owner's credentials. > Permissive Security allows for ~all security features to be disabled, and third-party kernels to be installed. No phoning home is required. Downgrading to Permissive Security requires booting in 1TR paired to the specific OS involved, and authenticating using machine owner credentials. It seems to me that you can boot into the recovery partition but in order to be able to boot Linux, you need to authenticate using machine owner credentials, which you only get if you go through setup of the OS, for which you need to accept the EULA. However, on the good news front, OP also writes that no internet access is required for any of these steps.