> the kernel changes too damned fast and the key would be tied to a particular kernel
That's not true, and it's not how it would work.
Your distribution will be able to package signed bootloaders (GRUB) and kernels. The kernels from your distribution should work fine as long as they Play The Game (which I suspect some, like Debian, will not).
As for the 'kernel changing too damned fast': First, you should know that Windows kernels are ALSO updated between service packs, the Windows kernel components change fairly frequently. Second, the kinds of distributions that get used in managed environments (like RedHat) don't get changed often at all, maybe twice a year. RHEL is still running patched revisions of 2.6.32 from January 2010.
I suspect that in the future, we'll have to 'root' our computers just like we have to root our phones today to load alternate firmware.