from what I gathered when I looked into it, the firmware developed and distributed by the SOF project is all free software, and it's designed to always be signed in order for it to be loaded. the twist is that they've made a public signing key, that works on some devices, and a private signing key, that Intel keeps to itself, that works on most/all devices. they distribute binaries signed with both of them, but only Intel can make the latter signatures, so, on devices that demand Intel's signature, that scheme renders the binaries nonfree, because users can't install or run modified versions. that much is Tivoization to the letter.

now, there might be more to it, and if there is, I'd love to learn about it.