>Currently, shim is signed with a Microsoft key from 2011 that expires on September 11. What security benefit did adding an expiry date to the certificate prov

>Currently, shim is signed with a Microsoft key from 2011 that expires on September 11. What security benefit did adding an expiry date to the certificate provide? "Oh no! Someone has gotten our secret key and is certifying new shims! ... Not to worry, the certificate will expire in 14 years. Everything is fine!" Does anyone know the rationale for such expiry?