I don't follow that argument. Say the EUFI boot used the last key you booted with... Windows PCs would boot just the same, securely using the Microsoft key. B

I don't follow that argument. Say the EUFI boot used the last key you booted with... Windows PCs would boot just the same, securely using the Microsoft key. But when you pressed Esc or F1 or whatever for a boot menu, instead of choosing what partition to boot from you choose which key. ie the list is 1) Microsoft, Inc. Operating System 2) Red Hat, Inc. Operating System 3) ... So even if somebody hacked Red Hat and stole their key and signed something malicious, the user would still have to select that key on boot in order for it to run. Maybe the boot menu would only list keys that verified an actual installed OS. In any case, just because you have a bunch of keys in the BIOS doesn't mean you have to automatically boot anything they sign.