(Asking out of ignorance...) Signed by whom? Who are the trusted CAs for secure boot? Can you import an arbitrary certificate as trusted?