The only tamper proof part is the hardware TPM. Everything else uses a chain-of-trust model based on signatures. Most of the complex work will be in windows; and that code can be updated just fine so long as updated versions of the kernel are digitally signed.

I’m sure there will be security holes early on. But the people pushing this stuff seem to be playing a long, patient game. I think they’re going to get what they want.