>Right now to achieve that level of security you have to manually enroll only the keys you want. Have fun with that process. There will still be the situation

>Right now to achieve that level of security you have to manually enroll only the keys you want. Have fun with that process. There will still be the situation with microsoft signing third party bootloaders, because various legitimate system utilities (eg. the kaspersky rescue disk mentioned in the OP) will still need it, and telling users to clear their keys willy-nilly is just going to train users to blindly clear their keys whenever something goes wrong.