Secure Boot
UEFI feature that verifies bootloader signatures before execution. Prevents bootkits/rootkits from hijacking the boot process. Microsoft requirement for OEM PCs since Windows 8 (2012).
PK (Platform Key) → KEK → db/dbx databases of allowed/forbidden signatures. By default contains Microsoft's UEFI CA → Linux distros get their bootloaders signed via "shim" signed by Microsoft. UEFI db can be extended by users (Machine Owner Key, MOK). 2024 security event: leaked MSI firmware keys broke secure boot for ~5 models. Combined with TPM for "measured boot".