Set who controls each layer of an endpoint. The score is a self-assessment, not a statistic: at every layer, either you (or an EU entity) hold the key, or a foreign vendor does.
Weights reflect how much a foreign lever at that layer hurts a sovereignty threat model, not how hard the layer is to change. Score = 100 × (sum of state × weight) / (sum of weight). A device that scores low is not broken; the number is a map of which keys to take back first.