The blacklist is a UEFI variable that can only be updated under certain conditions. It's possible to ship a signed blob that can add things to the blacklist, so it's possible to distribute an addition to the blacklist that's both verifiable and portable.

It'll protect us some as well, though the idea of using Linux to attack windows may cause an increase the number of attempts against Linux systems.

Motherboards that carry the windows 8 client logo must include Microsoft keys. Others may at their option.

-- pjones