I must have a thousand questions. I'm making one comment per question as that seems reasonable. Posted in no particular order. As of 2026-02-25 I have 22 questions.

I typed up all these questions not knowing there was a February AMA. I'll have to watch that later to see if any of my questions are answered there.

---

The trust anchor for secure boot is the PK. Do PKs expire? Has a PK's private key ever been leaked (do we have precedence for such a horrifying possibility)? How do vendors update their PKs (if that's possible)? Can you have multiple PKs (to service replacements with minimal disruption)?