Simple: Anything required for the hardware to function must be open source and user replaceable (no signed firmware, or at least a way to turn off signatures or load your own keys).