I'm pretty sure DigitalOcean was blatantly doing it anyway, and nobody even noticed.

It's rather awkward to me because it runs almost entirely through userspace or eBPF. Both of which are trivial to spoof and bypass.

You can create a fake efivarfs, fake integrity states, etc, and if they actually try to test the integrity features to see if it's true, you can easily determine that and conditionally provide the vanilla behavior.

That's why they require the other features (tmp2.0, secure boot, signed kernel)

You can't easily make a closed source kernel module due to the GPL.

Many Linux drivers (ethernet, gfx, wifi) use closed source binary blobs. Linus has said many times that he is fine with it.

EDIT: More info here: https://lwn.net/Articles/13398/

Same thing can be said for LineageOS too.

Yes, LineageOS doesn't have a different stance on those modifications.

Indeed, LineageOS doesn't officially support rooting *at all* anymore. They also ban Magisk from their communities IIRC.

You're losing a lot more than that:

- secure app spawning (huge because without it, many hardening improvements are useless)

- extremely secure memory allocator

- fully enabled MTE on shiba and newer

- relockable bootloader

- stronger forensics resistance

- more trustworthy developers (ever heard of LOSCoins?)

- rapid support for new Pixels

- lightning fast security updates faster than most OEMs/ODMs

- built-in TTS without GMS

- real GMS that isn't priv-app

and so much more

LineageOS code can update pretty fast, but the problem is they want to do refactors, and also that bringing up a hundred outdated devices is difficult.