Windows S failed hard so they have a new strategy. Every new CPU ships with M$'s Pluton root of trust. For 'security' everything will have to be signed. They consider the user to be the threat actor. Eventually they will charge a percsnt fee for using their signing service.