Re: Bug#766395: emacs/gnus: Uses s_client to for SSL.

[Florian Weimer]

* Perry E. Metzger:

> The trick is to make sure it isn't used as an instrument to prevent
> ordinary people from booting software of their choice, but rather is
> used as an instrument to assure that when they boot the software of
> their choice, they're actually getting that and not malware.

None of the existing boot verification technologies provides this.
It's also difficult to reconcile this with full user autonomy—if the
user can load previously untrusted key material (and especially if
this is an expected step during installation of a free operating
system), the firmware can no longer warn about malicious keys and
malicious software (because the user has replaced the trust root).