How will they check for a compliant kernel, at a technical level? I haven’t seen any proposed way to do that that can’t be easily circumvented.