>mandate that OEMS allow users to load their own certificates into their own UEFI, possibly with a self-signing process that allows that motherboard, and only t

>mandate that OEMS allow users to load their own certificates into their own UEFI, possibly with a self-signing process that allows that motherboard, and only that motherboard, to boot a given user-signed image, with self-signing only possible from within the UEFI UI, so OS-level malware can't generate valid certificates. Do you realize that Microsoft has done exactly that? There's so much hot air here that facts are getting lost in the blind raging and hating. Of course, they cannot dictate to OEMs because of the antitrust lawsuits, but it's a requirement if they want the PC to be Windows Certified and carry the Windows sticker.