I think they are right to try to exclude nonfree parts of Linux kernel, and to try to avoid Intel ME and other things like that (but they will need to try better to make improved hardware designs that can be used, which I would think would be difficult for an organization that deals with software), but the certification requirements are a bit too strict in my opinion (while I think there are legitimate reasons to mechanically disable the GPU and WiFi (to save power, avoid unwanted communications, etc), this should not be permanent; it should be possible to re-enable them if their functionality is desired, and free replacement firmware can be used (they could, if desired, make them disabled by default and not include any nonfree firmware with it so that they cannot be used without free firmware, I hope)), and I think they are wrong to remove "ns-do-applescript" (they could, if needed, put it in a separate file which can be omitted if you are not using AppleScript, and there is also possibility of making FOSS implementation of AppleScript in future on other systems possibly, even if for now there might not be).