Any protection that makes sense would use a real encryption mechanism, not an obfuscation like UEFI. The "secret" for UEFI SecureBoot is embedded in the "secure

Any protection that makes sense would use a real encryption mechanism, not an obfuscation like UEFI. The "secret" for UEFI SecureBoot is embedded in the "secured" system, so it is already in the wild (i.e. outside of the brain of the user) - not a secret at all. So I believe that a meaningful modern security setting would be based on some dm-crypt/luks ciphered storage and a passphrase to unlock it.