"You better have those software rid of security flaws properly signed!"

...

The guide is great and I've followed it to success several times. It fails whenever the odd vendor decides it should really offer a slightly buggy implementation.

For example one that will allow you to enter sb setup mode, clear EFI keys, but not offer a way to enroll new ones from the firmware setup UI. While simultaneously making the EFI KeyTool fail enrollment with a cryptic error message. :)

While the commands and procedures on this page still work fine (the screenshots are a welcome addition!), I find the Arch Linux wiki to be a bit more up to date: https://wiki.archlinux.org/title/Unified_Extensible_Firmware...

The Arch wiki also adds some additional warnings that you may want to check into. For instance, my Thinkpad with an Nvidia GPU will be bricked if I use the normal API to load secure boot keys, because on boot certain firmware is executed before the setup utility, which means that if that firmware fails verification, the entire laptop becomes unbootable. The workaround (load keys through the UEFI setup utility instead of any other tools) doesn't let me get rid of the manufacturer keys and take full control, unfortunately. I'll keep Lenovo's choices here in mind next time I buy a laptop.

Thanks to updates to sbctl, you can create keys with `sbctl create-keys` rather than typing out complex openssl commands. sbctl's `enroll-keys` should also make the key enrollment procedure easier.

Your distro probably also comes with an optional package manager hook so you don't need to repeat the sign commands every time your bootloader updates.