I'm not seeing the difference you're claiming. the SOF binaries and the signature (by an Intel-controlled secret key) on them work exactly like Tivo-supplied binaries and signatures (by a Tivo-controlled secret key): there's a component on the sound cards that checks for the signatures, just like on Tivo systems, and that prevents the binaries from running if the signature doesn't match.

now, you make it sound like the unsigned binary would still run, it's just other parts of the system that would cease to function. that doesn't match whatever little I have found, but... where can I find more information to understand how that (other?) problem affects us?

CC: @Simon Josefsson