UEFI's equivalent of the CRL is the "forbidden signature database" (or DBX) - but as far as I can see, it only has 658 entries (the source appears to be https:/

UEFI's equivalent of the CRL is the "forbidden signature database" (or DBX) - but as far as I can see, it only has 658 entries (the source appears to be https://github.com/microsoft/secureboot_objects/blob/main/PreSignedObjects/DBX/ https://github.com/microsoft/secureboot_objects/blob/main/Pr... ) Another potential use is to facilitate managed deprecation of obsolete crypto functions / protocols / hash suites / etc. That fits pretty well with a 10 year rotation period, and is probably more valuable in the long term than minimising DBX size.