it does, and it is. SecureBoot makes sure that the firmware your computer boots to begin the boot process is signed by a trusted authority. it does not check the firmware for bugs or somehow sense them and skip over that code or something.
The passive voice in "trusted authority" is pretty much the source of discontent in "SecureBoot."
Good point. Both are important: who does the trusting and how they define trust.
The latter is the second set of concerns: remote attestation.
I recall reading someone on Twitter mentioning having remote attestation for online banking. So starts the dystopia.
But yes, having a trusted chain can be a good thing. It depends entirely on the who, the what, and the how.
We don't.
Can you also re-sign the firmware and hardware checks as well? Last I knew you could not.
Of course, you can't dual boot anymore.
https://community.frame.work/t/solved-secure-boot-and-custom... seems to be a good read on it.