I believe this is similar to Microsoft's driver model, where at the end of the day, they decide what's signed or not and thus what can hook into the kernel.

Stallman was prescient.