KVM virtual TPM aka the "Universal Smartcard"

[Patrick]

@HulaHoop

please decide if we want this as a default feature

Decided no.

Reason:

Breaks tirdad or makes things more complicated with little advantages.

Discussion:

enable Linux kernel gpg verification in grub and/or enable Secure Boot by default

Since we are going for enforce kernel module software signature verification [module signing] / disallow kernel module loading by default, should we also work towards enable Linux kernel gpg verification in grub and/or enable Secure Boot by default? Looks doable in principle. KVM: supports both EFI boot and Secure Boot. On Snippet 0x0E: Booting image files and ISOs with KVM/QEMU (EFI and BIOS) - Philipp's Tech Blog see 2. Booting image files with KVM (EFI) The Debian -- Details of package o…

Wiki:

Secure Boot

Future:

Sovereign Boot