As your link mentions, that loader only loads signed kernels (with signed modules).
edit:
> designed to prevent malware
That's the official story. Anybody familiar with Microsoft's history knows they have been trying to lock down the wintel platform for a long time. Creating a "Trusted Computing" environment specifically for DRM purposes has been a goal since "Palladium".
