User talk:Sakaki/Sakaki's EFI Install Guide/Configuring Secure Boot/Using KeyTool

Still doesn't work on ASRock UEFI, it won't allow booting to the generic USB partition as long as there is a "Gentoo Linux (USB)" boot option. Any other way to run KeyTools in setup mode?

For that matter, isn't there any way we can just append the self-signed PK, KEK, and db certificates to the Windows ones on disk, before adding them with efi-updatevar? The ASRock UEFI Setup mode apparently locks in each key as it's updated instead of locking in all the keys when PK.auth is updated, so each key can be added once but not appended to, as the current process requires.