> This is also considered a security boundary - before ExitBootServices everything running has been subject to any secure boot restrictions, and afterwards appl

> This is also considered a security boundary - before ExitBootServices everything running has been subject to any secure boot restrictions, and afterwards applications can do whatever they want. This is how things are supposed to work, but in practice, the pro-tivoization corporate lobby has successfully gotten the "Secure" Boot restrictions to be enforced even after ExitBootServices is called. E.g., try to load an unsigned kernel module on RHEL or Ubuntu with it enabled.