Modern dev consoles use the same DRM scheme as the retail consoles, they simply use a different (most of the time per developer) certificate, and won't boot retail signed titles.

But there's nothing stopping someone who wants to play a game "for free" from finding a torrent of a retail copy, downloading it, stripping the retail signature off it, using the SDK tooling to apply their own developer cert's signature, and then booting that on their console.

It's certainly possible—and already done—with iOS.

Likewise, "homebrew" on such a system would probably be like iOS homebrew is currently: an ecosystem of open-source projects where users are expected to download, compile, and sign the binaries themselves using their personal developer certs.

> But there's nothing stopping someone who wants to play a game "for free" from finding a torrent of a retail copy, downloading it, stripping the retail signature off it, using the SDK tooling to apply their own developer cert's signature, and then booting that on their console.

The way this has been impeded on previous consoles is to encrypt retail executables and lock the key in some "secure" coprocessor. These obviously do eventually get cracked, but at that point the system is probably so thoroughly exploited that you can do everything with a retail console anyway.

You're exactly describing how iOS AppStore apps work, i.e. Encrypted binary segment that is decrypted when paged in.

I've seen systems that don't allow you to have direct access to the signing tools; it's an online encryption oracle.

With this setup, it could easily blacklist known retail binaries and refuse to sign them.