[avhwl]

Cool write-up. This is one of the things that interested me about the new T2 computers; having a secure boot process that loads every link in the boot chain using cryptographic signatures verified by an onboard TPM engineered by some of the smartest people in hardware security. This isn't a move by Apple to lock users into their platform, they do that far more effectively through other means.

[saagarjha]

It really looks like a boot verification process to restrict which OSes can run on the device, à la iOS, which can only run what is current and signed by Apple.