The Microsoft policies are unclear. I was around when Fedora came up with its current Secure Boot policies and may even have contributed to a somewhat maximalis

The Microsoft policies are unclear. I was around when Fedora came up with its current Secure Boot policies and may even have contributed to a somewhat maximalist interpretation. Fedora and others operate under the assumption that Secure Boot needs to prevent the execution of unsigned code in ring 0 (or the Arm equivalent), but is this actually required for a signature from Microsoft? Unclear. Plenty of distributions had their shims signed without kernel module signing implemented in the distribution. I think the current policy is here: https://techcommunity.microsoft.com/t5/hardware-dev-center/updated-uefi-signing-requirements/ba-p/1062916 https://techcommunity.microsoft.com/t5/hardware-dev-center/u... It doesn't mention kernel mode. The focus on kernel mode may not even be appropriate because many bad things can happen without kernel mode (wiping local disks, operating the hardware beyond safe parameters).