only allow YouTube in app and in seriously locked down Web-Environtment-Integrity browsers

This is exactly what they want. Remember their github with the OS integrity authentication service? They’re already there with phones and Chromebooks, now they have to control PCs.