Embed Notice

@bluca @pid_eins @siosm

You misunderstood. I secure the key by not having it available in a datacenter. Also the Image it signes will only boot on a single computer so the interest of anyone stealing it area also quite slim.

On ArchLinux every user typically generates their own keys and enrolls these self generated keys within their devices.

Also one can use a HSM if they want to but because of the limited scope it isn't really required.

As I said above entirely different use case...