I've never thought UEFI Secure Boot was a great idea, but Fedora paying Microsoft to get a signed boot loader feels, errrm, creepy to me.

On the bright side however, Fedora's boot loader is just a signature verifying loader to boot grub2 - using _Fedora's_ PKI. That's encouraging because at an ideological level it's exploiting Microsoft's process to give Fedora control over everything downstream from their loader. The name even implies that it's a kind of workaround: "shim loader." (Shim is defined in some circles as a compatibility workaround.)

I guess Fedora doesn't plan on becoming a signing authority for custom kernels, but in a pinch it could work.

Please, everyone start contributing to http://coreboot.org !

[Edited for clarity.]