I think the reason Microsoft are allowing OEMs to enforce Secure Boot is because Dell, HP et al are going to sell Windows 10 PCs that only run trusted code. [1]

I think the reason Microsoft are allowing OEMs to enforce Secure Boot is because Dell, HP et al are going to sell Windows 10 PCs that only run trusted code. [1] > With Windows 10 Enterprise edition and specially configured OEM hardware, administrators will be able to completely lock down devices so that they're unable to run untrusted code. > In this configuration, the only apps that will be allowed to run are those signed by a Microsoft-issued code-signing certificate. That includes any app from the Windows Store as well as desktop apps that have been submitted for approval through Microsoft. Enterprises with internal line of business apps can get their own key generator, which will allow those apps to run on their network but won't work outside the network. [1] http://www.zdnet.com/article/microsoft-reveals-audacious-plans-to-tighten-security-with-windows-10/ http://www.zdnet.com/article/microsoft-reveals-audacious-pla...