>UEFI Secure Boot doesn't completely protect against physical attacks. I didn't say it did. In fact I formulated what I wrote precisely to convey the opposite

>UEFI Secure Boot doesn't completely protect against physical attacks. I didn't say it did. In fact I formulated what I wrote precisely to convey the opposite message. >they can replace the currently active UEFI bootloader with a shim app, enroll their own key. UEFI can be protected by a password if the implementation supports it. How secure that is is of course up to the implementation.