Key Management

• Microsoft keys included with most (x86) PCs
• Logistics of being a CA
• Arm-based machines too
• And likely further architectures
• Multiple keyrings defined
• Platform Key (PK)
• Key Exchange Key (KEK)
• Authenticated Variable Database (DB)
• Revocation Database (DBX)
• later: MOK via shim
• On most machines you can modify the list of trusted keys