If I include Microsoft's keys in my secure boot setup, then any malware which has a Microsoft key can boot my Linux binary. Can I restrict my Linux binary to be booted only by a bootloader signed with my personal key?
I know I can sign the binary itself with my personal key, but that doesn't prevent malware with a different key from booting my binary.
If this is impossible, I can still sign the Windows binary with my own key and get rid of Microsoft's keys, right?