It's not flawed at all. But its purpose isn't actually to secure anything. Its purpose is to complicate the installation of alternative OS and to perpetuate vendor lock in, while sounding like it's "for your security". In that regard, it has succeeded.

There is also TPM and Microsoft Pluton, which serve the same purpose.

I get why you'd dislike that wording, but this is also how all certificate stores work, regardless of whether we're talking Secure Boot, Windows or Linux. Gotta trust the top level as providing legitimate certificates to then trust everything underlying as coming from the correct parties.

Certificate are something I work with constantly at work and I fucking hate resolving issues with them lol.

Add this to the pile of reasons why M$ is a joke and people should stop using them. Nothing they make is so good that you need to stick around.

A PKI without a CRL will eventually become exploitable.

I'd argue this is actually a popular opinion. IMO secureboot has just become a way for Microsoft to leverage it's position and keep a strangle hold on industries they have no business being in.

The whole kernel level anti-cheat on win11 bullshit in the gaming industry is a good example. Essentially locking games to its platform and willing to sacrifice security to do so at our expense.

That's like saying windows 11 doesn't need tpm chips, an extremely popular opinion

That's a very popular opinion.

Was it ever popular?

If the "working" definition is "is secure", and there's 11 ways in which it's not, is it not "insecure", aka. "not working" then?

Secure boot is supposed to be a lock.

Turns out there are 10 year old tricks that bypass that lock.

A lock that cannot deny access to people without proper key... is a bad lock.

Forgotten UEFI shims undermining Secure Boot

Better?

Crashstealer is still recent enough I see articles written about it.

If you want something secure learn secure practices.