I guess we'll see when my M1 air arrives this month. It's my understanding that by default they won't boot anything not signed by Apple, but I'm hearing scattered reports that there may be some command line configuration tool options that can cause it to disable boot security and boot unsigned stuff. It's certainly the default configuration, and on all of their other arm64 platforms they've shipped so far (iPhone/iPad/ATV/Watch), disabling the boot security is not a configurable option.

My fingers are crossed. We'll know soon.

EDIT: https://keith.github.io/xcode-man-pages/bputil.1.html