Secure Boot (in Debian)

• In discussion since ~2011
• Planned since 2012
• Adds some complexity
• Extra signed shim package
• Also sign: kernel, grub
• Changes to dak, d-i, debian-cd, …
• Ongoing (slowly)