it does not give Fedora "control over the whole process". It's not only the bootloader that is signed, it's also kernel and modules. And if any of these is comp

it does not give Fedora "control over the whole process". It's not only the bootloader that is signed, it's also kernel and modules. And if any of these is compromised, M$ can see that as a threat to a Windows installation on the same PC and revoke the "Fedora" keys. Not that M$ would have any incentive to do such a thing ever....