It's probably built on systemd's Secure Boot + immutability support.

As said above, it's about who controls the keys. It's either building your own castle or having to live with the Ultimate TiVo.

We'll see.

> Sounds like kernel mode DRM or some similarly unwanted bullshit.

Look, I hate systemd just as much as the next guy - but how are you getting "DRM" out of this?