Summary : Machines that have the "Windows 8" logo must have UEFI, which means the bootloader must be signed with a key that's in the BIOS. Additionally the OS can use the keys to check other signed code : device drivers etc.

My conclusion : A smart vendor will include a signed program that will manage said keys in the BIOS.