Comment by blueflow

Reminder: The UEFI/SecureBoot/systemd-boot stack is controlled by Microsoft as well. Microsoft signs our bootloaders.