> they can simply turn off the security model or adjust it.
I'd very much like to know what this involves. I'll feel better knowing how it can be done. If you have a link that would be great!
I'd very much like to know what this involves. I'll feel better knowing how it can be done. If you have a link that would be great!
Security-wise, that can be problematic, and I suggest you turn on EFI password authentication so it's not something everyone can do to your machine. This means you can still change the SIP settings on-demand per boot using a USB stick with rEFInd on it, but doing that requires you to chain boot off of that USB drive and doing that triggers EFI protection and requires a password before you can do that. Normal boot would not require a password and lets you use the system as-is.
Since this is a topic on VPN software.