UEFI Secure Boot support

[HulaHoop]

@Patrick

Waiting for @HulaHoop / input.

I had documented enabling UEFI as I was misled into thinking it was necessary for using vTPM in KVM. Patrick informed me that Sovereign Boot is the way to go for actual safety and freedom in this area.

Anyway while I don’t see the point of UEFI for real security, here’s how to do it:

KVM virtual TPM aka the "Universal Smartcard"

Made some headway and got UEFI working easily. @Patrick please decide if we want this as a default feature and if so, please see the referenced link below and choose the appropriate mode depending on whether you want to restrict unsigned boot or not and if you see value in storing the keys in the TPM in our threat model. Perhaps this discussion can be moved to its own thread. For TPMv2 activation purposes, the following has successfully been used to make it appear in the VM. <os firmware='efi'> …