Do I understand this right? Hardware manufacturers for the ARM based Windows 8 devices are required to only allow Microsoft signed boot loaders on their devices

Do I understand this right? Hardware manufacturers for the ARM based Windows 8 devices are required to only allow Microsoft signed boot loaders on their devices? They are not allowed to provide a "switch" to disable this signature check? If they want Windows 8 on their devices they have to lock out every non-signed OS? How does Microsoft make sure that Windows 8 does not run on unlocked devices? Or is this only a legal/licensing matter?