Josh Boyer wrote:
If you are creating a cert to sign the out-of-tree modules and
expect
it to be accepted by the kernel, it cannot be ephemeral. A user would
need someway to import it into their kernel or have it passed from
grub. The only way to do so is to have it embedded in shim or the
kernel during the build of those binaries. I do not foresee Fedora
creating yet another persistent key to sign things with, which means
you would need another tool that can use the existing key in the
kernel builders.
That just proves that Restricted Boot and especially our implementation of
it (requiring kernel modules to be signed) is a very bad thing.
Kevin Kofler