It works only because Linux distributions boot through a MS signed binary called "shim" which allows to import the distro key to allow booting. That's still a m

It works only because Linux distributions boot through a MS signed binary called "shim" which allows to import the distro key to allow booting. That's still a much worse experience than with the "root of trust" MS key.