The root of trust is in Secure Boot, and you have control of those keys. That means you maintain control of your machine - it's always possible for you to boot modified code that checks your signatures instead of any manufacturer's.

For PCs you do control MOKs, for now.

For mobile devices, or for devices like Chromebooks, you don't. It is only matter of time, until PCs change too, with apologies like 'nobody uses it anyway, why complicate things' etc. The frog must be boiled slowly, otherwise it backfires.

Chromebooks are explicitly designed to permit re-keying, although it does require you to physically disassemble the machine[1]. And if anything, we're seeing more user-unlockable mobile devices now than we did in the past. At the high end, server vendors want to maintain control of their keys, and there are large companies who want to do the same for corporate desktops and laptops. At the current rate, the frog's going to die of old age before it notices anything.

[1] The reasons for this design choice are understandable, even if I disagree with them

Not all Chromebooks require physical modification for re-keying. (The Dell Chromebook 11 doesn't, for example.)

> As with any other tech - the important thing is who holds the keys.

I may not agree with your whole post, bit this is key.

It's about control of your own hardware and it's gradually being taken away. One piece at a time.

That is what happens when freedom gets abused.

Like the freedom to run my own choice of operating system?

Or the freedom to reset my device to a known-good state from read-only media so I know it's safe to use again after potentially being compromised through these slightly-too-clever new reprogrammable systems?

No the freedom that any programm has full rights of $HOME, to access the network, to manipulate everything that the user under it runs also can.

I don't see the connection.

Your point seems to be about the chosen operating software's security model. I agree that flexibility here is woefully lacking in all the major desktop OSes today.

However, the original concern in this case seems to be about being able to choose the basic operating software for the system itself, which is an orthogonal issue to the one you're raising as I understand your comment.

The lack of security for major OSes and the exploits that were caused by the freedom to install software from any source, which lead to the said software being able to do anything in user's name, is what lead to solutions like application stores and things like SGX.

Because the average Joe and Jane users don't understand anything about security, and prefer to loose freedom than having their computer exploited.

But the modern measures about locking down the hardware itself, which are the subject of this discussion, have nothing to do with app sandboxing and app stores...

Which freedom exactly was abused?

Edit: also if something can be abused it is not a freedom but a granted temporary privilege.

To run software with full rights of $HOME or similar, acess the network and manipulate PC contents without the user knowing about it.