To the "Who will be left out?" question, mandates like these should come with statutory {must issue} requirements. Much of the Secure Boot crap could have been

To the "Who will be left out?" question, mandates like these should come with statutory {must issue} requirements. Much of the Secure Boot crap could have been avoided if all devices had been required to have a user-accessible mode that trusted a must-issue signer of last resort, and that signer was broadly available. E.g. LetsEncrypt for devices If on the one hand we want to improve security via encryption/verfication, then on the other hand we must remove the governments' and corporations' abilities to abuse it.