I'd be interested in further reading on Google's outreach to big banks and major finance CO's ( or others) pushing for device attestation if you have any further reading.
https://sfconservancy.org/copyleft-compliance/vizio.html https://sfconservancy.org/blog/2021/mar/25/install-gplv2/ https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t... https://events19.linuxfoundation.org/wp-content/uploads/2017...
But the Linux kernel is GPLv2, and only v2. For better or worse, locking down the bootloader is (probably) pernitted with the Linux kernel.
Having heard so much about anti-Tivoization when the GPLv3 was being drafted, and the discussions about it on linux-kernel when Linus decided the kernel will remain GPLv2-only, I was left with the impression that the GPLv2 only required the provision of source code, build scripts, etc. but not the ability to reinstall a new version. [1] makes a pretty good case that the ability to reinstall is also required GPLv2, and I'm heartened that's how Tivo saw it too.
[1] https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t...
Right now, it seems to be fairphone or pixel, or old phones which are not easy to obtain. Samsung have announced they will lock their phones, and how long before google locks pixels?