But they also move the gatekeeper from the distribution to Canonical, and only Canonical (sideloading does not count when the repo is hard coded and server is closed source).