I thought MS's ARM-based devices would refuse to boot anything that is not cryptographically signed with a set of MS-controlled keys. If that's still the case, then they're pretty locked in my book.