I must have a thousand questions. I'm making one comment per question as that seems reasonable. Posted in no particular order. As of 2026-02-25 I have 22 questions.

I typed up all these questions not knowing there was a February AMA. I'll have to watch that later to see if any of my questions are answered there.

---

Microsoft is leading the rollout of these new certificates but even Hyper-V (at time of writing) won't support the KEK updates until March at the earliest. Why does Microsoft seem unprepared for these updates at the first-party level? Doesn't this compromise the "secure by default" mission? If Microsoft isn't keeping their own platform up to date, why would we expect all other OEMs will be ready in time for the expiration dates?