Comment by jmb99

If you roll your own keys (preferably in a local HSM and use PKCS#11 for signing, with some kind of local auth) then it’s actually quite a good security feature. Obviously not for Windows, but trivial on Linux. It’s very easy to set up a hook for apt (or whatever package manager) to re-sign your kernel/init/modules on updates (requiring whatever your auth source is, password probably good enough for most people) and then as long as you’re booted with secure boot enabled, it’s a lot harder for someone with root to escalate further. Which you can then go down the rabbit hole of hardening the system to prevent becoming root, etc.

Pretty useless if you use Microsoft’s keys. But with your own, depending on the attack surfaces you care about, can be pretty helpful