The process

• Using your own keys is possible and (sometimes!) easy
• Enrol your own keys in the firmware
• Or: use an existing shim and add keys to MOK
• Per machine...
• Build a shim including your keys, get that signed by Microsoft
• Reproduclble binary build
• Submit for review, paperwork
• Reviewed by the shim-review team
• If all goes well, you get a signed binary back
• But...