Implementing UEFI Secure Boot in Fedora

So, if you write a new operating system for x86 PCs, and want to distribute it to a non-technical public (thus having to be able to boot directly from the install media without extra steps), you need to have it signed by Microsoft.

That reminds me of an old science-fiction story...

"[...] you could not install one if you had one, without knowing your computer's root password. And neither the FBI nor Microsoft Support would tell you that." -- https://www.gnu.org/philosophy/right-to-read.en.html

And by the way, who really believes the signing service will stay the same forever? How long before the price increases? How long before the requirements increase, like not allowing users to run non-sandboxed unsigned code? And how long before competitor keys start being blacklisted, with some flimsy excuse ("your kernel was used by someone to bypass Windows DRM and copy a DVD, so we are revoking your privileges")? Finally, how long before the ability to disable secure boot is removed also from x86, like it will be on ARM?