Linux and Secure Boot certificate expiration

It's totally crazy that we have to go through Microsoft to sign things to be able to have our OS run on third parties computers, and that Microsoft manage to win about this so easily as it was never seriously challenged.

It makes more sense if you view it for what it is: Honest Satya's Certificate Authority.

Microsoft showed they can semi-competently run a PKI. The end.

Now had the Linux folks stepped up to the plate early on, instead of childishly acting like Secure Boot was the computing antichrist, the story might be different. But they didn't. We only have shim because some people at Red Hat had the common sense to play ball.

Call me childish, but I don’t want to ask Microsoft to sign a certificate for me before I install software onto my own hardware.

I don’t care if it’s required for every installation of if it’s once per hardware. I want to install software without asking a third party for permission. I want this to be doable entirely offline.

Plus, keeping Microsoft’s CA installed greatest reduces any security which I’d get from SecureBoot.

> Plus, keeping Microsoft’s CA installed greatest reduces any security which I’d get from SecureBoot.

Can't you just remove all CAs from the UEFI and import only your own anyways with most mainboard vendors?