> I might be misremembering it, but initial plans for Secure Boot were less open. It was only the stink raised that resulted in it being an option.

That, and fear of antitrust enforcement. The only reason we're still allowed to disable secure boot, or enroll our own keys, is that alternative PC operating systems already existed and were popular enough, that attempting to restrict PCs to only run Microsoft-approved operating systems would raise serious antitrust concerns.

But we're still at a serious risk. Microsoft still has enough influence over PC manufacturers to dictate their hardware requirements, and it would only take them being less afraid of antitrust to require them to no longer allow an override. They are already making things harder with "Secured-core PCs" (https://download.lenovo.com/pccbbs/mobiles_pdf/Enable_Secure...).

“ . But not only were they illegal, like debuggers—you could not install one if you had one, without knowing your computer's root password. And neither the FBI nor Microsoft Support would tell you that.”

That’s what trusted boot is, as predicted in 1997. It will come eventually.

For those who don't know the source of that quote: https://www.gnu.org/philosophy/right-to-read.en.html which was first published in 1997.