I don't see why this is specific to Chromebooks. On x86_64/UEFI, I can sign my Grub EFI loader, load my keys into secure book (delete the stock/microsoft ones), re-enable secure boot, password it and now I have a reasonable expectation that I am booting the OS I think I am.

It'd be nice if Google opened up their actual bootloader so you could do the same with Chromebooks without needing 3rd party tools.