For instance today if you install Fedora and select encryption for the drives, /boot is still not encrypted (what would decrypt /?). Your data is secure from offline analysis, but anybody can walk up and replace /boot to record your password (not to mention more complicated hacks) the next time you use it.

So verifying the bootloader with EUFI is a great thing that must happen. It could be completely transparent to most users -- their system works the same, it's just more secure. The problem is that Microsoft has engineered it so in practice only their key can be on the system to unlock it. Once this scheme gets established they might even be able to maintain a 'windows tax' just to unlock the hardware even if you don't even use their OS. That's really the only negative about EUFI.