I'm confused, but maybe you can enlighten me: This article talks about using a tool called KeyTool to manipulate the keys stored on the machine. But if software

I'm confused, but maybe you can enlighten me: This article talks about using a tool called KeyTool to manipulate the keys stored on the machine. But if software is capable of doing that, wouldn't that defeat the whole purpose of UEFI to begin with? How is it ensured that it's the user operating KeyTool and not $MALWARE? Why does KeyTool even run on a locked-down-by-MS machine? Have they signed it as part of the Linux Foundation bootloader? Why would they do such a thing? I don't mean for protecting-the-monopoly-reasons, but for straight security reasons as this clearly circumvents anything they were trying to accomplish. I seem to be missing a piece of information here.