Hm, interesting point. They've effectively made themselves the perfect gate keeper. Even for people like us on HN, I highly highly doubt hardly anyone outside of mjg59 has ever enrolled their own key.

I'm even highly interested in PKI and SecureBoot and have been quelling FUD about it for sometime but if I ever buy a non Pixel/MBA device, I'll leave the MS key in there almost assuredly.