If ARM implements the UEFI specification then there are escape hatches to enroll your own PKI.

I don't own ARM machines with UEFI so I have no clue.