Here's my rant on how Secure boot should be done. Currently, you have Microsoft's public key certificates in the firmware, and you can either boot with secure boot on or off. I would rather that the certificates be treated similar to a web browsers, where you have a list of "official" certs belonging to multiple independent entities. In addition, when in secure mode, you shouldn't be able to boot from unsigned media.
Now here's where I think this can be improved. Usually, hitting something like F12 at boot time gives you a list of devices to boot from (internal drive, USB devices, DVD, network, etc). What I'd like to see added to this is an item labeled "Boot from unsigned DVD/USB/Network [for OS installation mode]". Once this is selected, whatever you boot would have access to adding additional certificates to the firmware. Or, more appropriately, you should be able to select 3 boot options: 1) boot from signed media; 2) boot from unsigned media; 3) boot from unsigned media with write access to certificate key store [OS installation mode]. That way, the end user can still maintain complete control over their hardware, yet still get the benefits of protection against boot sector malware / low level root kits.
This sounds like secure boot's "Custom Mode." 'Certified for Win8' requires that all non-ARM machines support either Secure Boot Custom Mode or SB disabled. I would hope they would support custom, but that's the manufacturer's prerogative.
I have a simpler solution: the bootloader is kept on a separate storage device, which can only be written to if the computer is booted up in a special mode. No signing needed, prevents common bootloader viruses, respects user freedom.
Now here's where I think this can be improved. Usually, hitting something like F12 at boot time gives you a list of devices to boot from (internal drive, USB devices, DVD, network, etc). What I'd like to see added to this is an item labeled "Boot from unsigned DVD/USB/Network [for OS installation mode]". Once this is selected, whatever you boot would have access to adding additional certificates to the firmware. Or, more appropriately, you should be able to select 3 boot options: 1) boot from signed media; 2) boot from unsigned media; 3) boot from unsigned media with write access to certificate key store [OS installation mode]. That way, the end user can still maintain complete control over their hardware, yet still get the benefits of protection against boot sector malware / low level root kits.