[bombcar]

You can satisfy both if there's a physical connection on a chip somewhere that you have to manually cut to disable the secure boot option - that leaves clear physical evidence that you did it, and would satisfy the free software types.

[salawat]

...No, that would satisfy the "We don't want to support these people" crowd. Full end user control over the secure boot chain, or GTFO.

Nothing less is acceptable. Corporates will never do it however, because they're up to their elbows in "deliberately not implemented".