That’s the second best thing as long as you don’t worry about nation state actors (you’re fucked by then anyway). Only requirement is a board/laptop manufacturer with a proper uefi setup (eg ability to set your own keys, not using those “do not use” test keys, etc) - that usually comes with business machines.