Comment by wmf

There are ways to block unsigned modules. You also need to lock down /dev/kmem which apparently distros already do.