UKIs are good for secureboot/measureboot, because you can sign the uki, and everything inside of it be validated for secureboot. If you really like to have a secure chain without a uki, you need to validate all the boot components. You can do it with grub and gpg signatures, but is more simple to use an uki and a efi bootloader like systemd-boot
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments