>it's pretty trivial to create your own signing keys and enroll them in the MOK Aleksa, I know you are probably aware, but if keys can be added by a user then

>it's pretty trivial to create your own signing keys and enroll them in the MOK Aleksa, I know you are probably aware, but if keys can be added by a user then the mechanism is not really achieving verified boot. The keys need to be burned into a read only portion of memory if we hope to protect against evil maid style attacks. Unfortunately this conflicts with the "user freedom" side of the hardware. Wish there was a good solution for device owners and only device owners to own their keys.