> GPL cannot compel you to open source your code or to give out security keys. They can seek damages against you if you violate the license. FSF's stance on th

> GPL cannot compel you to open source your code or to give out security keys. They can seek damages against you if you violate the license. FSF's stance on this seems to be different from yours. Quoting from the blog post[1]: >This fear is unfounded and based on a misunderstanding of GPLv3. We have not been able to come up with any scenario where Ubuntu would be forced to divulge a private signing key because a third-party computer manufacturer or distributor shipped Ubuntu on a Restricted Boot machine. In such situations, the computer distributor -- not Canonical or Ubuntu -- would be the one responsible for providing the information necessary for users to run modified versions of the software. See the last line? So basically FSF is claiming that the private key must be divulged, just not by Ubuntu, but the OEM. What if the OEM is a Ubuntu partner? They would be in a bind, having to chose between divulging the key(and probably having it revoked when a rootkit starts using it) and throwing their OEM partner under the bus. As you said, if the bootloader is easily replaceable with something with a more open license, why subject yourself to this possible headache? [1] https://www.fsf.org/campaigns/secure-boot-vs-restricted-boot/whitepaper-web https://www.fsf.org/campaigns/secure-boot-vs-restricted-boot...