> But there's nothing stopping someone who wants to play a game "for free" from finding a torrent of a retail copy, downloading it, stripping the retail signature off it, using the SDK tooling to apply their own developer cert's signature, and then booting that on their console.

The way this has been impeded on previous consoles is to encrypt retail executables and lock the key in some "secure" coprocessor. These obviously do eventually get cracked, but at that point the system is probably so thoroughly exploited that you can do everything with a retail console anyway.