I just don't have this paternalistic instinct to try and protect people from rootkits. Even if I did, this is certainly the wrong way to do so—you need to hold

I just don't have this paternalistic instinct to try and protect people from rootkits. Even if I did, this is certainly the wrong way to do so—you need to hold companies accountable for the flaws in their software (for which we have basically no legislation at the moment) or they have no incentive to make the regulations meaningfully protective. Otherwise you just end up with shipping hardware that's still insecure, but checks the right regulatory checkboxes, and still restricts people from using the hardware they bought, and still no way to remediate when something inevitably does slip past the regulatory controls.