Code signing and boot security has its own place in the users' toolkit.

Personally, I've added my own keys to UEFI, and am signing my bootloaders and kernels, and I've enabled Measured Boot, which means that binaries I didn't sign/don't have a trusted signature aren't run. (a la Aegis)

The problem is when manufacturers take away your control of the security mechanism, locking you in and taking away your ability to not-be-babied.
(See: iOS code signing, Surface RT, Verizon Droid*)