The trouble with CAP_SYS_RAWIO

It takes a bit, until curious, but uninformed readers learn what this article is about. "CAP_COMPROMISE_KERNEL (formerly known as CAP_SECURE_FIRMWARE) is a new capability designed for use in conjunction with UEFI secure boot, which is a mechanism to ensure that the kernel is booted from an on-disk representation that has not been modified" would have made a great first sentence for this article. It's also nice at the end of the second paragraph, but why not put it in the limelight of the first paragraph, where it rightly belongs? Just saying... ;)