It strikes me that this option was intended as a compromise for a certain transition period after which it might be removed completely, at least on consumer boa

It strikes me that this option was intended as a compromise for a certain transition period after which it might be removed completely, at least on consumer boards. Besides the point is to be able to use Secure Boot without having to play by Microsoft's rules and restrictions. Why not have an equivalent of Let's Encrypt for secure boot, i.e., a non-profit foundation or a cooperative committee that distributes the master key and allows everyone (including MS) to get their kernels signed? That would be the best of both worlds. Instead we're moving farther away from it gradually.