The more frustrating thing about those machines is that there are two Secure Boot root keys in the MS program, one for Microsoft products (e.g., Windows) and on

The more frustrating thing about those machines is that there are two Secure Boot root keys in the MS program, one for Microsoft products (e.g., Windows) and one for everyone else, including both third-party hardware drivers and third-party OSes like Linux distros. But on the ARM Surface devices, Microsoft built them so all of the UEFI binaries were signed by the MS-themselves key, so even if you got an MS-signed key like this article is talking about, it wouldn't let you boot a non-Windows kernel.