mjg59 – Microsoft's Compromised Secure Boot Implementation

This is a much clearer explanation than others I've seen.