I guess the problem can be solved by using the two-level boot mode (privileged and non-privileged). In the privileged mode, you can change the keys and BIOS and whatever you want and you can develop whatever software you want to go with the same. And in non-privileged mode, nothing can not be changed.

The basic problem with not having such a system is that one would not be able to install one's custom BIOS/UEFI for whatever reason one would want to.