Is Microsoft mandating all OEMs/hardware vendors to configure secure boot with a MS signing key?
Basically yes; it's required to get the Windows sticker. I haven't heard that MS charges money to sign bootloaders, though.
Basically yes; it's required to get the Windows sticker. I haven't heard that MS charges money to sign bootloaders, though.
If you look at the UEFI requirements for Windows 10[1], specifically clauses 19 and 20, it says for non-ARM systems the user MUST be able to put Secure Boot into Custom signature-checking mode.
[1] https://msdn.microsoft.com/windows/hardware/commercialize/de...
The whole story around Secure Boot could be understood (even without a tinfoil hat) as a part of a slippery slope to lock out alternative OSes, highly recommended post: https://www.phoronix.com/forums/forum/phoronix/general-discu...