I personally dont think MS did it out of maliciousness, more indifference. They wanted the security benefits, and didn't care what it cost others. But we'll likely never know what their true intent was.

They originally tried to design Secure Boot where the OS could never add a key, that would have made sure it never worked for Linux. It wouldn't have prevented Linux from running as long as Secure Boot was disabled, but IIRC a lot of people were worried that manufacturers would end up making it mandatory and it does generally complicate the install process for new users disabling it.

I dont know how the bazzite script does it, but any tool that can be executed from userspace that could add keys could just as easily be abused by malware to add their own signing keys, which completely defeats the purpose.

It just calls the mokutil command which is what's generally used on Linux to enrol keys, it's what the official NVIDIA docs recommend to install the keys for the driver kernel modules. It's just four lines and two of those are echos to make things look prettier for the user.

In an ideal world, Redhat, Canonical, Suse etc could have gotten their verification keys built into every motherboard, but that still cuts out the Arch/Gentoo/flavour-of-the-month crowd. And also increases the risk that a signing key gets leaked and abused by malware.

I mean, everyone is already using a pre-signed "shim" released by Microsoft, that's what this whole situation is about, the certificate for that is about to expire. If RedHat, Canonical, SUSE and Debian all had their own certificates included by manufacturers, they could have released their own "shims" for other downstream distros to use and kept things entirely within the Linux ecosystem. Yes, it would have increased the risk of a signing key getting loose, but I personally trust RedHat still more than Microsoft, even after all the stuff they've done.

Still, it's entirely possible to securely get an OS key into your devices keystore. If you download an ISO onto a trusted device and check it's SHA256 hash against the one provided on the distros website, you can verify its authenticity. Then flash it, disable secure boot on the target system, install it without giving it internet, enrol its keys using similar steps to what the Bazzite script is doing (there are plenty of guides online for various distros) and only then give the new system internet access, the chances of something nefarious worming it's way in are very very slim.

It's also all about your personal threat vector. If you're just an average joe or joette then this is going to be a perfectly acceptable method because no one's going to want to access your system that badly. Corporations are data-hungry, but it's the same rule as bike locks, as long as yours isn't the weakest one on the rack, they're gonna steal a different bike. However, if you're an activist, journalist or (god forbid) a politician, then you should be buying a device that has the new windows key in the BIOS, and not disabling secure boot.