4 ms·
Production surface devices have intel bootguard enabled and the public key fused into the pch. You'd have to bypass it somehow.
by Avery3R 8y ago
Production surface devices have intel bootguard enabled and the public key fused into the pch. You'd have to bypass it somehow.
- cyphar 8y agoThat is only used to check firmware signatures, not UEFI binary signatures. You should be able to add keys to DB and KEK at your leisure. Also Microsoft has a paid program to sign UEFI binaries (that's why you can boot most Linux distributions on secure boot hardware).