> You could write an unlocked signed bootloader on the board, that is valid and boots and that can boot into anything.
True, but almost no one does this (Google/Chromebooks being an exception).
It would be a hugely positive step if manufacturers were required to ship/escrow/provide an unlocked bootloader to sell their products.
Unfortunately, that isn't the case today and it's only through goodwill that this is possible.