OEMs sometimes have the ability to change the root certificate. I know this because at work we were looking into having a signed OS for a regulated/certified product, and we wanted it to be our root certificate instead of microsoft's.
Though it's not true of all motherboards/BIOSes that you can change the root cert. And in general I would say that the proprietary nature of BIOSes today is becoming as big an issue as the proprietary nature of operating systems 30 years ago, and we probably need to start exerting more pressure on hardware vendors to support coreboot or TianoCore or whatever other open source BIOS is popular.
OEMs sometimes have the ability to change the root certificate. I know this because at work we were looking into having a signed OS for a regulated/certified product, and we wanted it to be our root certificate instead of microsoft's.
Though it's not true of all motherboards/BIOSes that you can change the root cert. And in general I would say that the proprietary nature of BIOSes today is becoming as big an issue as the proprietary nature of operating systems 30 years ago, and we probably need to start exerting more pressure on hardware vendors to support coreboot or TianoCore or whatever other open source BIOS is popular.