Some Linux bootloaders such as RHEL's are signed by Microsoft to avoid having to manually enter a new trusted cert into the EFI.