If Dell writes a kernel patch they will fail Windows accreditation and not be able to ship Windows.

I think Chrome should treat user CAs as untrusted and require a click wrap before proceeding.