I still don't understand why it needs to be implemented as part of systemd, and not - say - as a service. Or, if we want to "go with" the law - make it a kernel module, which sounds more impressive ("we are complying at the kernel level!") but in practice so much easier to opt out of.