Ah, so a signed firmware bootblock that runs something user signed? I wrote the original version of the boot Shim that Linux distros use for bridging from the Microsoft root of trust to the distro one, so let me know if there's any way I can help out here.
