Secure Boot
A UEFI feature that only runs bootloaders and drivers signed by keys in the firmware's allowed database.
Secure Boot keeps a key hierarchy in firmware variables: the Platform Key (PK), Key Exchange Keys (KEK), the allowed signature database (db) and the forbidden database (dbx). Each boot component must be signed by a key in db and not hashed in dbx. Linux distributions boot via shim, signed by Microsoft's third-party CA, which then verifies GRUB and the kernel with the distro's key.
It stops bootkits that replace the bootloader. It does not stop signed but vulnerable components: BlackLotus (2023) abused CVE-2022-21894 in a legitimately signed Windows boot manager, which is why revocation through dbx updates and Secure Boot Advanced Targeting (SBAT) matters, and why revocations sometimes brick dual-boot systems.
Operational point: the original Microsoft Secure Boot certificates from 2011 expire in 2026, so fleets need the 2023 certificates in db and KEK to keep receiving boot manager updates.