Matthew Garrett

If you know how to customize this, then you should be able to sign your own code (or disable the requirement, which if it will not be implemented, the OEM will be boycotted by IT enthusiasts...as in who is asked what to buy).
The discussion starts with the main loader started from HDD. That loader can be customized to contain your own key (with a little hassle, but required only once) with which you could build your stuff (including signing your kernel code).
The whole point of UEFI security started with executing only TRUSTED boot code. By default, it's MS-trusted ("Windows logo") which RedHat negotiates for a signing. But the writer specifies that they want to get to a common ground in which the trusted decision comes to the user.
GPL is not involved in this whatsoever. The code itself will be distributed, which can be used without the keys (which is data, not code) provided deactivation is available(which is OEM dependent). I don't think the GPL requires to be able to obtain the identical binary.