The issue here is that there are things like NVIDIA drivers that require rebuilding the kernel for legit reasons. If those kernels were already rebuilt and signed by the arch team, or somehow there was a way to know the signed version of the baseline kernel and list which utilities were added on top when recompiling the kernel, there would be a way to know for sure that there's no fucking kernel level cheats, which would kill all the fucking kernel anti cheats running around.
But they prefer to bitch and moan and enforce total control instead.