SFLC: Microsoft confirms UEFI fears, locks down ARM devices

The Xbox keys never got hacked or stolen. Unlike with SecureBoot, the xbox signing keys need to be applied to thousands of binaries from third parties; the SecureBoot keys need only be exposed to a handful of Windows 8 bootloader builds. Microsoft knows how to manage the bank-vault security of their signing keys and processes (well, the Xbox division does, at least; Microsoft is a very, very big company, so it's quite feasible for one division to be highly competent while another is hopelessly idiotic, I suppose).