[mpldr]

UKI isn't by redhat but by the Kernel devs, iirc. No redhead certs required. If you want to run with secureboot, you can use your own certs, but you can also just skip SB.

[nottorp]

Not certificates, certification ? As in Red Hat Valued Engineer or whatever they sell.