So you exploit the kernel (or some driver), do whatever evil shit you want, then lie to the signed malware checker. You now have an APT that ignores this whole

So you exploit the kernel (or some driver), do whatever evil shit you want, then lie to the signed malware checker. You now have an APT that ignores this whole notion of secure boot. Come to think of it, this is every modern rootkit. You try to remove it and it reinstalls itself. There's not intrinsic reason why you have to modify the kernel that sits on disc. Now there are lots of other checks and features you can add (that already exist) to make it harder to get access to the kernel, to make sure that unknown objects are purged or flagged on reboot, etc. The thing is, this secure boot doesn't seem to significantly make your machine more secure than current TPM-based methods involving sealing a hard disk decryption key that is only unlocked based on checksums of firmware, nvram, bootloader, kernel, etc.