I think that key can be changed on Google Pixels. I run GrapheneOS and reverting to stock would require erasing the key.

Outside of tech circles most people think secure boot looks something like this

The way it should work is that during the OS install the OS can ask to have a cert added to the keystore at which point UEFI pops up a screen that says something like:

An application has requested to add a new certificate to secure boot which will allow new software to run at boot up. This usually happens when installing or updating an OS. If you would like to allow this press and hold <5 randomly selected letters> on the keyboard for 5 seconds. If you don't want to allow this press and hold escape for 3 seconds.

This would at least be a vendor agnostic way of enrolling certificates instead of the MS certificate just always being pre-installed. It should also of course be publicly documented exactly how the process works so everyone can use it.

Well considering that the “UEFI Shim’s” role is to sit in between a Microsoft owned certificate signing chain, it is certainly part of it’s primary role.

With Linux distributions supporting UEFI Secure Boot, the above-described Secure Boot mechanism built around Microsoft keys introduces some challenges. Every Linux distribution generates its own bootloader binaries, and each of them has a different hash. Getting every Linux bootloader signed directly by Microsoft would be slow, bureaucratic, and impractical (if not impossible) to maintain across all Linux distributions.

The solution to this problem is a shim: a small, minimal first-stage bootloader that Microsoft can vet and sign once, and which then creates a secondary trust anchor for the rest of the Linux distribution-specific boot stack – usually GRUB 2 and the Linux kernel. This trust anchor is another certificate, referred to as a vendor certificate (managed by the distribution vendor), added to the shim binary before it is signed by Microsoft.

No.

Secure Boot is basically a 'lock', on the UEFI.

UEFI - Shim is basically a 'lockpick'.

UEFI is the first step in your computer booting, turning on.

So, if Secure Boot is supposed to be a 'lock', that limits who can access the UEFI ... but it turns out that there are many, old, UEFI - Shims, that defeat that 'lock'... then Secure Boot is not a good 'lock'.

I don't mean to be rude but it seems like there might be a bit of language confusion going on here... In English, a 'shim' is a kind of crude/simple tool that can be used to break or bypass some actual physical locks.

So 'UEFI-Shim' basically means 'a thing that breaks into your UEFI'.

I think that Victor may not have English as his primary/first language, I am trying to use a simple comparison that is more likely to convey the general, fundamental concepts.