The blacklist has to be signed by MS presumably before it can be installed? You can still just disable SecureBoot though, right? (Until the day MS specify "SecureBoot must be mandatory")
Posted Oct 19, 2012 16:32 UTC (Fri) by mjg59 (subscriber, #23239)
[Link]
Blacklist updates have to be signed by a key that's present in KEK - in the common case, that'll be Microsoft. And yes, disabling Secure Boot will mean that the blacklist is ignored.