> You can disagree, and it is unlikely that you'll change my mind. I'm not looking to change your mind, merely pointing out how absolutely pointless is signing

> You can disagree, and it is unlikely that you'll change my mind. I'm not looking to change your mind, merely pointing out how absolutely pointless is signing if private keys are public. At that point just don't sign, and don't add the silicon/firmware that verifies the signatures - less cost designing/testing/manufacturing/supporting the hardware. The point of signing the firmware/bootloader is to make it more difficult to employ boot chain exploits. If you don't care that anything that even briefly gains root on your machine (curl|sudo bash) can proceed to permanently backdoor your OS in a way that's undetectable from the inside, just disable signing. /shrug > A nice compromise is what my old Acer laptop does. You can disable the windows public key, and put your own in place if you want to run a CA, or you can just tell it to trust whatever boot loader is currently installed [...]. Either Microsoft, or the EFI standards body (under MS's direction; can't remember the details here) mandates that users must be able to enroll their own signing keys, at least on x86. I haven't run into PC hardware that doesn't allow you to do this, but then I'm not dealing with a lot of PC hardware regularly. The story is a bit different with Arm EFI - Microsoft tried to ape Apple and make it mandatory to NOT be able to enroll new first-party keys; meanwhile Apple skipped EFI on Arm Macs, and just allowed third-party OS's like they did on Intel. I'm not sure what's the story with signing a third-party OS on the Arm Macs, but I wouldn't like to run one unsigned.