Usually whereby the open source kernel is signed, such that: - The system will not boot if the wrong kernel is in place - The system will disable DRM if the wrong kernel is in place. DRM as required (err, petulantly demanded) by 3rd parties, generally requires top down security such that the: TPM chip trusts the boot loader which trusts the kernel which trusts the application And if anything along that chain is broken the DRM can be compromised. Anything else is just intense obfuscation that can be broken by those with the necessary time (see AACS and software BD players.)