> It's certainly the case that Ubuntu's approach is a lot easier to implement: in particular they don't do any kernel lockdown either, so you can load random ke

> It's certainly the case that Ubuntu's approach is a lot easier to implement: in particular they don't do any kernel lockdown either, so you can load random kernel modules, have untrusted IOMMU operations Not true. If you don’t believe it, try installing virtualbox from Oracles prebuilt repo (which doesn’t do DKMS). Their vbox.ko won’t load with Secure boot on, because it’s not signed. The solution is to load vbox with signed modules from the Ubuntu standard repos.