As long as the option to use secure booting stays user-configurable (even if it's opt-out), this sounds like a great way to for example do theft deterrent - if you can mark a specific macbook's serial number as stolen, and thus preventing internet recovery or reinstalls from external media, just like you can with iOS devices today via Find My iPhone, where Apple may deny granting a re-installation AP-ticket for the device's serial number, all the better.

If word gets out to every shady character that stolen macbooks are effectively bricks, perfect.