Foxboron
Backup old keys before enroll a new key
Would it make sense to move this to it's own efivar? Or should it just be written to a directory?
Writing it to a directory seems more appropriate. I think it would be even better reminding users to save both old keys and new keys to a external storage device(e.g a USB flash drive), because it's difficult to access certain hardware (such as encrypted hard drives soldered on the motherboard) or EFI variables when errors occur,
Regarding keys created by sbctl, they aren't valuable for users because it's easy to generate and enroll new keys and resign the unified kernel image. I would recommend not to backup them in order to reduce the probability of leaking them.
Should be fixed with https://github.com/Foxboron/sbctl/commit/af36eca1bce5c1b9bb1fe8ab5ba58528fcf945c7