I think there is a little more paranoia here than is justified.
Without a chain of trust starting before the boot loader, it is impossible to verify that installed boot code is actually from a trusted source and has not been modified in transit or in production, post install via OS exploit.
The past 30 years has proven that writing secure code is a hard problem. No one has managed to write a 100% secure commercial (or free) OS thus far.
So, we assume the OS can (one way or another) be compromised.
If we can manage to write a secure bootstrap process (which, being much smaller should be easier to achieve) that can validate boot code has not been tampered with via code signing, we at least (in theory) have a secure platform to boot from.
This isn't about Microsoft attempting to get a monopoly on operating systems. They've already been sued for abusing their monopoly OS position. You think making x86/x64 machines boot only microsoft signed code would fly anti-trust wise? Of course not. It will be switched off.
This is about ensuring the security of the OS is not compromised before it is even booted via pre-boot malware. Linux, BSD, etc. could benefit from this as well if someone is willing to officially bless/sign the boot code. How do you think all those Vista activation hacks worked? - subverting the OS pre-boot...
There's currently little to stop someone putting out a new Linux/BSD bootloader that roots your system, other than peer code review, but even then, an exploit in the OS could lead to malware being installed to the boot sector post OS install.
If the EFI can detect unsigned code in the boot sector, you'll know about it. If it can't the OS has no way of detecting such a compromise (other than boot from confirmed clean media - which again you can't confirm has not been tampered with close to 100% without code signing), as any attempts to detect can be subverted by the pre-OS-boot code.
IMHO this is a much needed option for securing your machine(s). I'd rather see the alternative platforms take advantage of it, than the idea being crippled via lawsuits...
To establish a chain of trust pre-boot, there's no other way MS or the PC industry could do this. Having it turned on by default is a refreshing "secure by default" strategy. If you want to run unsigned code, so be it, turn the option off. However, if you're wanting to do that you're more cluey than the 99% of users out there who this will protect - and should have no problem doing so.
And yes, I suspect that to modify the EFI keys, you'll need to boot the machine in some sort of read/write EFI mode. Having the keys modifiable by an exploitable OS at run time would be retarded. Once the (signed) bootloader has finished, the keys should become read-only (but i'm not sure if this is what they've done) - similar to the way kernel securelevels work.
