Fedora considers deprecating legacy BIOS

not to mention that even with secure-boot disabled the system will _still_ verify the signatures of firmware updates before flashing them, and possibly will even verify the signature of the stuff in the ROM before starting to execute it (so you can't just unsolder the ROM chip and flash it manually, without going through whatever it's connected to).

Heh, come to think of it, my desktop's firmware doesn't really do anything to indicate secure-boot is off, so if someone just went and disabled it I might not know! Same with my laptop. My Surface tablet does indicate this in firmware (the boot-splash gains a huge red warning).

I think secure-boot (implemented well, like you gotta sign the initrd, come on) is probably useful against like, customs officials quickly adding a boot-kit onto your disk though, which is worth defending against for a lot of people.