(Also, the last time I looked, TPM keys could be grabbed with ~ $100 of hardware, but I think that's fixed by some newer standard.)

But, yeah, it's not a big tradeoff in practice. I think their point was that Apple had to expend effort to enable the use case, which isn't "hostile" toward the use case.

There are other issues as well.

For instance, on a PC the security settings are applied per machine and not per partition, so you can't mix an unsigned OS on one partition with full security on another partition.

Also:

> On Wednesday, researchers at security firm ESET presented a deep-dive analysis of the world’s first in-the-wild UEFI bootkit that bypasses Secure Boot on fully updated UEFI systems running fully updated versions of Windows 10 and 11.

Despite Microsoft releasing new patched software, the vulnerable signed binaries have yet to be added to the UEFI revocation list that flags boot files that should no longer be trusted.

https://arstechnica.com/information-technology/2023/03/unkil...

This wasn't true for a low-end Acer I bought a while ago, and it's not true on an Asus motherboard I use. You can add keys to the bios, and then it'll let you run with either key. That lets you use the grub shim key. On the Acer, you can even tell it to screw PKI, and just check that the hash of the bootloader hasn't changed.

The gaggle of moving parts that are involved in the PC world make security and privacy substantially more challenging because of nonsense like this - a vendor with rubbish security (not even an HSM for critical signing keys!) compromising the broader world.