> So what shim with an empty internal key list gets you is analogous
> to this plan
Ah I see, thanks for the info ... does that mean that when I want to boot a LiveCD (say), I have to write stuff (even "empty" stuff) to the UEFI boot variables of the machine? Or can shim just bypass all of that and, in effect, provide the same "always present user" boot style that the LF approach takes? At some level, I guess I am asking if shim is a complete superset of the LF approach.
There may be times or reasons that someone booting doesn't want to write to the firmware of the box ...