> on a laptop the first bootloader can be installed by the user and nothing checks its signature? It should be signed by the manufacturer, so you shouldn't be

> on a laptop the first bootloader can be installed by the user and nothing checks its signature? It should be signed by the manufacturer, so you shouldn't be able to. Loaded by a shim even smaller in the CPU, part of Boot Guard and Platform Secure Boot, if I'm not remembering wrong. > say on Linux, if Secure Boot verifies up to my /boot partition (does it?) No. It verifies one signed file, usually Grub EFI shim. Which then should check everything you want. Unlike Windows, desktop Linux distros rarely have the best SB system. Poettering has described this issue in depth.