"The last option wasn't hugely attractive, but is probably the least
worst. Microsoft will be offering signing services through their
sysdev portal.
It's not entirely free (there's a one-off $99 fee to gain access), but
it's cheaper than any realistic alternative would have been. It ensures
compatibility with as wide a range of hardware as possible and it avoids
Fedora having any special privileges over other Linux distributions. If
there are better options then we haven't found them. So, in all
probability, this is the approach we'll take. Our first stage bootloader
will be signed with a Microsoft key."