Garrett: Responsible stewardship of the UEFI secure boot ecosystem

Restricting to Microsoft-signed OS might not stop someone booting their own Windows from a portable device, I guess, since I suppose it is signed by Microsoft. But in any case, does this buy much additional security? If someone has physical access to your machine, they could steal it, substitute it (to fool you into using it and then getting keylogged), replace the motherboard (same), and any defences to those attacks (e.g. encryption) would also defend against someone booting another OS, I think.