That shift has already started in various areas. You see it with phones but also with cars where OEMs require Secure Boot enabled devices when possible. This r

That shift has already started in various areas. You see it with phones but also with cars where OEMs require Secure Boot enabled devices when possible. This ranges from the central unit to all small ECUs. You can kind of see it pushed for desktops as the default mode but at least there for now you usually have a way to disable it. For embedded devices though they never really provide a way to disable it. I think you could find a compromise where you could provide a physical method to disable it. If you disable it you clear all the DRM keys and other secrets. This way you can still protect against malicious updates for most users and tinkerers can do what they want once the company stops supporting it.