The reason "secure boot" (yeah, scare quotes intended) is not the default for linux distributions: > The boot loader and kernel must be signed with a trusted k

The reason "secure boot" (yeah, scare quotes intended) is not the default for linux distributions: > The boot loader and kernel must be signed with a trusted key recognized by the UEFI firmware. Microsoft maintains a widely trusted key for Secure Boot called the Microsoft UEFI Certificate Authority, and many Linux distributions use it to sign their boot loaders and kernels. This enables them to boot on systems with Secure Boot enabled by default.