>security by obscurity

Don't confuse having secret keys as "security by obscurity".

That's not what the phrase means. Else SSH private keys are "security by obscurity" too...

Of course it will. The iOS security model fundamentally depends on everything from the bootloader up being codesigned. Releasing the root signing keys completely destroys this. Nothing on the system can be trusted anymore if that happens.

Edit: Well, I guess the secure enclave can be trusted. But nothing else can be.

IANAL, but if they had a way for a legit owner of the device (for some definition of being able to prove that) to use their own keys in addition to the apple ones then no security is compromised and gpl3 is satisfied.

It bothers me that you are confusing Apple's policy choices, which are not inevitabilities nor are they without dissenting opinions, with security, suggesting there is no possibility to satisfy the latter without making the same choices as the former.

It can still require signed code. I just want to swap Apple's key for mine. As the owner of the device, by definition, I am the sole arbiter on what is considered trustworthy. Executing only programs that I have personally approved (and thus carry my signature) is the perfect implementation of that policy.

Now, I might be lazy or busy and delegate that responsibility to Apple or some other third party. There may be mismatches between my preferred policy and what is enforced by my proxy, but it might still work reasonably well overall. We humans do it all the time. No reason the CEO has to make every single decision themselves.

When the stakes are high and I don't want to risk that nuances of my set policy get lost in translation or when it's about things that are totally outside my proxy's area of expertise, I'd prefer to make the decision myself.

With iDevices, I can't. There's only the delegate model and the only available proxy to choose from is Apple.

PS: Releasing secret signing keys to the whole world is an obviously bogus suggestion. Please stop beating up this strawman.

It's not a strawman. It's what would have to happen according to the GPLv3. The fact that you could design a system that allows for user-replaceable keys doesn't change the fact that iOS is not that system, and that if GPLv3 code gets into iOS then, according to the terms of that license, owners of existing devices would need to be allowed to replace the code. And the only way to do that is to release the root signing keys. You can't say "well they could design a future device to allow this", because that hypothetical future device isn't what we have today.

It's a bit more complicated, since you don't want a third party (e.g., your local police or your abusive ex) to be able to open your bootloader and run a modified OS that dumps your private data the next time you log in. This is completely straightforward on a modern desktop (unless you're using something like Bitlocker with TPM), but is supposed to be impossible on iOS.

This is exactly why switching a Chromebook into developer mode wipes all user data.