Embed Notice

@bluca @pid_eins @siosm
"for normal users" ArchLinux isn't necessarily for normal users.

What is worse in having the uefi signing keys compared to being able to place your malicious script within the build path of an UKI and thereby getting pulled in and (because you don't know about it) signed by you after entering the pin?
None. Both actions require the attacker having root permissions on your system...