Locking down would be pretty trivial. Require code signing of bootloader. They already do this on all their other platforms.