If I compile the kernel from source, I'd hope to have the choice to disable Secure Boot. (But I'll probably get a hand-me-down sony laptop and that won't be a c

If I compile the kernel from source, I'd hope to have the choice to disable Secure Boot. (But I'll probably get a hand-me-down sony laptop and that won't be a choice.) Hopefully, the spec will require that I can install a new key. If I'm going to the effort to generate a public/private keypair, I should really save the private key on, oh, a removable drive. Then on a separate removable drive (Matthew Garrett's suggestion) I create the UEFI bootable kernel and add the public key. 1. The BIOS asks me if I want to install the new public key on the removable drive - I say yes 2. I tell the BIOS to boot from the kernel on the removable drive 3. I install the kernel and OS to the internal drive 4. Each time I reboot, the BIOS already has the new key saved, so it accepts the kernel 5. If I build a new kernel and sign it with the same key, I can install it on the internal drive or on a removable drive, and the BIOS will boot it