if unprivileged software can ask the integrity verifier component which private key is used as the integrity root, or what rules does the verifier keep, then it can be used by commercial software (and web browsers) to decide whether they allow running themselves on your computer (or whether you are allowed to watch netflix, or log in to the bank’s or the government’s website)