[drdaeman]

To be fair, I think this is only for tablet & mobile.

On desktops and laptops I've seen, there was a way for end-user to upload their own trusted certificates and use those instead of Microsoft ones, and I think that's when done like this (when, whatever the defaults are, end-user can get in control), Secure Boot is a good idea - even though the implementations are not.

I guess there must be some ignorant (or malicious) desktop/laptop vendors that don't provide key management options, but hope there isn't many.