Well SB on Linux allows you to sign things with a Machine Owner Key. The threat model here is a physical attack that either boots an unauthorized operating sys

Well SB on Linux allows you to sign things with a Machine Owner Key. The threat model here is a physical attack that either boots an unauthorized operating system or modified the binaries, how useful it is in the real world for most people I don’t know but it can provide some mitigation or at least a detection if someone is trying to mess with your boot sequence hastily like at the airport or overnight at the office. Basically you can say that if you lose control over the machine it’s not secure anymore which is somewhat true but in reality you can lock down the UEFI effectively enough that without any known vulnerabilities or bypasses even TLA will probably need quite some time to break into it especially without raising any alarms. The other threat model is that as long as the MoK signing key is not on the machine, any malware that compromises it won’t be able to add persistence in the bootloader layer.