> It must also support secure authenticated updates to the databases. This does not imply "the user must be able to add their own keys". (Particularly as that

> It must also support secure authenticated updates to the databases. This does not imply "the user must be able to add their own keys". (Particularly as that would not usually be "authenticated"). Secure Boot keys include keys which (in theory) are used to authenticate an update to the key database.