I have a simpler solution: the bootloader is kept on a separate storage device, which can only be written to if the computer is booted up in a special mode. No signing needed, prevents common bootloader viruses, respects user freedom.