Finally, sensible. I never understand why websites or apps had to do it. It's way easier, more scalable and cheaper for the OS to do it.
"Our systems aren't foolproof because anyone can just boot Linux from USB. Hence we should enforce secure boot with proprietary keys and disable functionality for non attested PCs"
This is not far fetched. All Android vendors went down this path and now you can't even enable developer mode if you want your bank app to work to approve your bank loan.
IMHO requiring every to submit notarized paper forms to access Facebook/whtvr would be the best solution