A centralized key is not secure. A secure key is not centralized. If you want any security, the computer owner must be the only person allowed to install keys on the boot sequence - what is the exact opposite of what MS mandates.
A centralized key IS secure, just not AS secure as a not private key.
(That's theoritically: in practice it can be even safer than a private key, because most end users are incompetent in managing their keys much more than the central entity would usually be).
And it's wrong to think it as a key in the sense of a physical key. It actually used as a signature.
You can't have "private signatures" because the very purpose of a signature is to verify that the thing it signs is signed by a specific (and in the case of operating systems, central: the vendor) entity.
An OS the user signs itself is worthless, as the OS data he signed could have come from anywhere or tampered, etc, before the signing.
Or get those Linux community to organize, and establish some body to create, and secure, keys for Linux that will be installed by default alongside MSs.
As someone who suffered from at least a couple BIOS-based malware back on Windows PCs back in the day, I'm all for securing the bootloaders...