@mjg59@nondeterministic.computer
Post #3973294
2026-07-21 00:11 UTC
@crlf@infosec.exchange you can, but that's not the situation I'm talking about - people may want to stay in the existing ecosystem but not trust the Windows keys (because the Windows bootloader doesn't have a good security track record), and be able to automate that (which rules out manual configuration)
Replies (1)
-
@crlf@infosec.exchange 2026-07-21 00:16
@mjg59@nondeterministic.computer I get how that would allow you to distrust the Windows keys. But unless you already have an alternate boot CA, you would get locked out. (or you could be running with boot verification disabled, in which case whether they are trusted or not is irrelevant)