This is where TPMs, measured boot, and remote attestation come in.

You can run whatever kernel you want, but if it is not an approved kernel, you wouldn’t be able to attest to running an approved kernel; allowing whatever DRM scheme the developer put in to active.

I believe this is how the higher levels of Android’s Play Integrity system work.

I was shopping for a new vacuum cleaner when a saw a portable carpet cleaner. Basically a vacuum with a precision nozel bolted to a water sprayer. It has been a complete game danger for cleaning up the mess my cats would sometimes leave. Although it is still not as effective as the course of dewormer their vet prescribed.