Hacker News Reader

All of the manufacturers that I am aware of allow you to load your own keys.

MS also requires allowing for user replacement of all keys.

But only on x86_64 and not on ARM, right?

They require that you have the ability to change the keys; remove the Microsoft ones, load your own keys, etc.

The problem is that they don't specify any kind of common interface for doing so, or standard for key formats, or anything of the sort. So how it works can vary greatly between manufacturers, or may be buggy, or the like. So several prominent Linux distros have decided to ship bootloaders signed with Microsoft's keys, so that people can just install the distro without having to go through some hardware specific key loading process that may brick their machine.