as broken as CAs, but at least you can wipe the keys in uefi and load your own keys and sign your own kernel with it - actually the real secure boot.