You just mandate the scanning into the OS, then mandate what OSes hardware is allowed to boot.