Comment Re:Microsoft issues the Linux keys too (Score 3, Informative) 48
Microsoft issues the secure boot keys that are used by all Linux distributions.
If they can just arbitrarily yank someone's keys like this, apparently without explanation or appeal, then what does that mean for those Linux keys? Are they subject to withdrawal for no reason as well?
Incorrect. Microsoft signs the boot shim. This lets you use Secure Boot with the default Microsoft keys you use to boot Windows. So any PC, with Secure Boot enabled, can boot Linux. The keys built into every PC are Microsoft's, and even if you hard reset the machine, they will revert to those Microsoft keys.
You are encouraged though if you run Linux, to create your own keys, and install them on your PC. Doing so would require you to re-sign the Microsoft bootloader but you are free to use your own keys. The only reason Microsoft signed the shim is because some OEMs do not make it easy to install a third-party key to secure-boot a non-Windows OS. So the Microsoft signed shim means if it can boot Windows, it can boot Linux.
And I say shim because that's the actual component signed - major Linux distributions re-distributed the signed binary. But it's bootloader independent - you can use the signed shim to boot your own version of GRUB or other bootloader and continue the secure boot chain if desired. (If you use something like Ubuntu, you're likely to encounter this if you try to compile your own kernel or module where you then h ave to add a key to the shim so the kernel can run your new module.
Microsoft can stop signing new shims, but that has nothing to do with Secure Boot. It's just a way so everything that can boot Windows can boot other OSes even if the OEMs lock down the computer.
Big companies often use their own keys for secure boot.