> А почитать внимательнее не судьба, да?
>> Важно подчеркнуть, что это не PKI-ключ, применяемый для формирования цифровых подписей к исполняемым файлам, а ключ для отключения проверки в загрузчике, не влияющий на надёжность работы прошивок UEFI
> Тем, что утекло - свой зловредный загрузчик вы не подпишете.

Читать внимательно желательно оригинал:
https://gist.github.com/anonymous/c94cadade3a8b87dcdc52c639f...

> The "supplemental" policy does NOT contain a DeviceID. And, because they were meant to be merged into a base policy, they don't contain any BCD rules either,
> which means that if they are loaded, you can enable testsigning. Not just for windows (to load unsigned driver, ie rootkit), but for the {bootmgr} element as well, which allows bootmgr to run what is effectively an unsigned .efi (ie bootkit)!!! (In practise, the .efi file must be signed, but it can be self-signed)   You can see how this is very bad!! A backdoor, which MS put in to secure boot because they decided to not let the user turn it off in certain devices, allows for secure boot to be disabled everywhere!
>  You can see the irony. Also the irony in that MS themselves provided us several
> nice "golden keys" (as the FBI would say ;) for us to use for that purpose :)
>