I imagine also anyone who, despite being on an approved distro, has had to enroll their own key to build and sign drivers as well.

Gentoo users and people running Nvidia drivers and the like will be out, that's true. That's very different from "only certain architectures allowed", though.

Even still, there are ways to implement this using an open source, signed, reproducibly built daemon that gets loaded early in the boot process. Altering the daemon would've out of the question but it would solve the more immediate problem of "Netflix doesn't work" that most people would actually care about.

Netflix can only discriminate because we have attestation in the first place. This is not a security mechanism anymore.