315
Secure Boot is completely broken on 200+ models from 5 big device makers
(arstechnica.com)
This is a most excellent place for technology news and articles.
Your want to store a copy of the private key on the encrypted machine so it can automatically sign kernel updates.