They could offer both locked down signed software on top of their hardware and allow for bypass when the user wants to install their own thing. I prefer by default to have locked down signed chain of software bootstrapping but I do want to also have the ability to use my own.