crlf

@mjg59@nondeterministic.computer I see now. I was conflating the Microsoft and Windows keys. I don't think MS would do that, though 😆

@mjg59@nondeterministic.computer I get how that would allow you to distrust the Windows keys. But unless you already have an alternate boot CA, you would get locked out. (or you could be running with boot verification disabled, in which case whether they are trusted or not is irrelevant)

@mjg59@nondeterministic.computer if I remember correctly, you can install your own "UEFI CA", and replace the default ones. Of course, that has the drawback that you then need to handle your own "UEFI CA"...