"If you don't want to trust Microsoft, disable Secure Boot, or sign your own boot chain. You can do either." This only works so long as Microsoft's Windows certification requires that OEMs include a way to turn it off. It may be a bit of a stretch, but really there is little preventing Microsoft of a few years from now imposing the same onerous requirements on x86 systems as they currently do for ARM devices. I doubt they'd get away with it, but w/e. While I'm not saying such will come to pass, that's when the big problems will start to cause headaches for people. For now sure, just turn it off if you want nothing to do with it.