[josephcsible]

> Being able to enroll your own keys (or disable secure boot entirely) is a requirement for being a compliant implementation.

That may be true on x86, but on ARM, Microsoft specifically requires that you not be able to do either of those things:

> 13. On ARM platforms Secure Boot Custom Mode is not allowed. A physically present user cannot override Secure Boot authenticated variables (for example: PK, KEK, db, dbx).

> 18. Enable/Disable Secure Boot. On non-ARM systems, it is required to implement the ability to disable Secure Boot via firmware setup. A physically present user must be allowed to disable Secure Boot via firmware setup without possession of PKpriv. A Windows Server may also disable Secure Boot remotely using a strongly authenticated (preferably public-key based) out-of-band management connection, such as to a baseboard management controller or service processor. Programmatic disabling of Secure Boot either during Boot Services or after exiting EFI Boot Services MUST NOT be possible. Disabling Secure Boot must not be possible on ARM systems.

[NekkoDroid]

That is true, but I wasn't talking about those considering we are on a post about x86 MoBos (I guess I could have clarified that).

And until this requirement on ARM is changed (or there are options I can buy which allow it) I don't consider it a secure platform.