Not to be glib, but this is true in much the same way as secure http. Really the only way to do it properly is to control the root key for your organization. The chain of trust starting with the vendor you got the computer from is bonkers.
If my preferred OEM offered me the choice between a locked-down opaque system, and an /equivalent/ system that is completely open and verifiable, I'd choose the second option every single time. I expect many would as well.