zlacker

> For instance, on a PC the security settings are applied per machine and not per partition, so you can't mix an unsigned OS on one partition with full security on another partition.

This wasn't true for a low-end Acer I bought a while ago, and it's not true on an Asus motherboard I use. You can add keys to the bios, and then it'll let you run with either key. That lets you use the grub shim key. On the Acer, you can even tell it to screw PKI, and just check that the hash of the bootloader hasn't changed.