I have been reading up on the details of Secure Boot, in particular the authorized and forbidden databases:
Before enabling UEFI Secure Boot (by setting the PK) the white and black lists DB & DBX must be set up with authorized and forbidden certificates and signatures. Recall that DB contains authorized signing certificates and images while DBX contains blocked signing certificates and images.
The above is from http://gschwinds.net/cache/SigningUEFIImages-1.31.pdf
What is the point of having the black list DB when we have a white list DB already? If a certificate/signature is found to be comprised, wouldn't just removing it from the white list be enough? Am I missing something here as the black list DB of comprised signatures/certificates just seems redundant to me.