Well, for ARM devices, Microsoft doesn't allow OEMs to provide a way to change the keys. For what it's worth, I think Microsoft are doing this for the security

Well, for ARM devices, Microsoft doesn't allow OEMs to provide a way to change the keys. For what it's worth, I think Microsoft are doing this for the security reasons they give. But I think they were well aware of the hurdle it would present to Linux distributions when they chose to do it.