> OK. First, a dumb question: what does secure boot buy you that can't achieve by locking the BIOS down to booting from the internal hard drive anyway?

Secure booting prevent rootkit malware which infects your bootloader or BIOS. The firmware will authenticate the signature of the code. If there is any tampering, it will refuse to boot.

The concept of secure boot is a good idea, but this fiasco shows how dangerous it can be if abused.