Apple Silicon machines have a "permissive security" mode which allows booting unsigned third party kernels. Asahi isn't circumventing anything, this is a officially supported feature.