... and unless your bootloader appears in that list-- is signed by one of those signing keys, ...
... Now, give the bootloader the power to suspend any running operating system to disk, encrypting ...