With enrolled keys and a password protected bios that refuses to add boot options to the boot menu, and refuse to boot existing options if the signature no longer matches, you can't be booting malicious files.