I have yet to see a machine that doesn't have a tainted kernel (meaning the kernel wasn't signed, a module wasn't signed, or both) in the wild. Not even with Ubuntu.

At the same time, requiring TPM 2.0 is the same anti consumer thing Win11 did.

Secure boot is a pain to set up on Linux because it was never meant to be for Linux. It's a Microsoft invention that Microsoft holds the keys for.

Kexec is useful on a lot of machines for faster reboot times, and disabling it can make them significantly longer.

LSM BPF is scary and sketchy, especially if you're giving a proprietary blackbox access to it. You should not have random software accessing that.