That's part of what I meant. Under what circumstances would you want that? In particular, I would expect the kernel command line to form an essential part of the trust chain; if you can change the kernel command line, even if you can't change the kernel, that seems like enough to break security.