Matthew Garrett

The original LF plan was to allow secure boot checks to be bypassed by simply pressing a key, thus verifying that the user is physically present at the computer. It looks like now the only options are:

- Use Shim with a signed bootloader and an embedded public key that matches the bootloader, and get MS to sign it. This is what the big distros like Ubuntu, Fedora and SUSE are doing.
- Use a generic Shim with a signed bootloader, and rely on the user to navigate the filesystem and add the public key to MOK.
- Use the LF loader with a generic bootloader, and rely on the user to add the hash to MOK.

These all require either dealing with MS, or a user sophisticated enough to handle enrolling keys/hashes in a pre-boot environment. Are there any plans to support a present-user check, as originally envisioned by LF?