“This Platform Key, which manages the Secure Boot databases and maintains the chain of trust from firmware to the operating system, is often not replaced by OEMs or device vendors, resulting in devices shipping with untrusted keys.”
BIOS vendors hand out test keys with “DO NOT TRUST” written in the certificate issuer. Device makers shipped them anyway. More than 10% of tens of thousands of firmware images use one, from May 2012 to June 2024, and the private half of one AMI key leaked from an ODM. Secure Boot has been a sticker on the box for 12 years.