- notarization, code signing and revocation - sandboxing - root of trust hardware encryption None of the above can be enforced at a distribution level, and w

- notarization, code signing and revocation - sandboxing - root of trust hardware encryption None of the above can be enforced at a distribution level, and where these features are opt-in they’re significantly underdeveloped relative to Windows/macOS/ChromeOS as no-one is using them in significant numbers. I’m not even sure you could find any amount of FOSS advocates to even get on board with notarization let alone get it implemented. You could maybe enforce protected folders at the distribution level but I don’t know if anyone could really trust a feature like that if it wasn’t implemented in the kernel directly.