The problem is that the UEFI would not be writable (at least if you aren't lucky), so you can neither remove MS key nor add your own. If it would, of course ma

The problem is that the UEFI would not be writable (at least if you aren't lucky), so you can neither remove MS key nor add your own. If it would, of course malware would install its key and remove MS one to make machine only bootable with their payload.