Like… where does the default windows signing keys come from? Isn’t that like hard embedded into the BIOS/UEFI when the hardware is made? If so, how does Linux even use Secure Boot? Does it somehow replace the keys when you install a new OS?
I tried googling, but all I find is just simple pages that doesn’t have much detail.
Basically it works by every component validating the next one before loading it.
They do this by checking a cryptographic signature. Specifically, UEFI checks that the bootloader is signed by a certificate that is in turn signed by a certificate authority (CA). You can upload custom CA keys in the UEFI interface.
Per default, every UEFI ships with the Microsoft CA. That does not mean you can only run secureboot with Windows and you absolutely should enable secureboot on every machine you own. Microsoft does sign other signing keys allowing them to be also used with secureboot. For example, every major Linux distro has keys signed by the Microsoft CA and so secureboot works out of the box with those.
Even if you have an OS that does not have a signing key signed by the Microsoft CA, you can upload your own secureboot keys to get around that.
It should be pretty clear at this point that all of this is pointless if you do not set a UEFI password.
This is a good answer.
To add, for Linux kernels, the maintainer use a shim EFI package with the distro’s keys (e.g., Canonical’s keys for Ubuntu) which loads the maintainer-signed kernel. And Microsoft signs the shim to keep the chain intact.