Would have to be the system vendor, not Microsoft. Or rather, if MS could do it then the whole scheme is a sham, the authentication is supposed to be at the firmware level, not in the OS.

UEFI is turning into a huge mess. I'd look to the Coreboot stuff being pushed/supported by AMD as a much better path to the future, and try to think of ways to club Intel's NIH-adled brain into getting on board.