Garrett: Why UEFI secure boot is difficult for Linux

What you'll have to do is take advantage of "custom mode" to allow a user/installer to use their own keys. This mode is described in the kernel.

As far as 'boot loader' malware, it's not rare to install data into the MBR to make it easier for your virus (or whatever) to re-infect a machine.

The latest Windows malware I have had the misfortune to run into latched itself into the NT kernel's block driver stack at the lowest level. It had the capability of creating new subvolumes on the root file system and installing itself to that. This little trick meant that even formatting the file system and re-installing Windows wasn't enough to get rid of it permanently (although it was not clear if it could somehow re-install itself in a new installation. It doubt that would be possible unless it hooked into the MBR or something like that).