> No, the machine (if set to full security) needs a signed ticket from Apple specific to your hardware (ECID) to run.

Thanks. I see now that it's somewhat documented by Apple, except the plaintext aspect. So it seems that "Reduced Security" would be the workaround.

https://support.apple.com/guide/security/startup-disk-securi...