Does this mean that I need to get the private key to Microsoft for them to sign? Can Microsoft then record my key and impersonate me?

Or can Microsoft sing an NSA backdored Linux so it appears that is "secure/genuine"?

If the answer is yes to one of those then for me seems fair that someone would say that "it is not secure book if I can't remove Microsoft)NSA keys) and put my own and confirm it worked)" , seems to be a push for sanity that failed , like how we failed and we have now DRM into the browser.