Here is a current list of keys that are considered well-known for use as Secure Boot signature database (db) keys and Machine Owner Keys (MOKs), which we plan to expand over time:
- Canonical Ltd. Master Certificate Authority - used by Ubuntu and derived distros like Linux Mint
- Fedora Secure Boot CA - used by Fedora and derived distros like Silverblue
- Universal Blue - used by Bazzite, Bluefin, Aurora, and derived distros
- Debian Secure Boot CA - used by Debian and derived distros
- openSUSE Secure Boot CA - used by openSUSE and derived distros
- SUSE Linux Enterprise Secure Boot CA
- Rocky Linux Secure Boot Root CA
- Microsoft UEFI CA - used to sign non-Microsoft components like the Linux bootloader shim project
- AlmaLinux Secure Boot CA