On Ubuntu and possibly Debian systems, you can install packages which contain images which are signed by Ubuntu's EFI key. For example, linux-signed-image-generic-lts-trusty is one of these packages.
Say I have a fully-encrypted disk and an unencrypted boot partition, as is required. I use a PGP encrypted key file to decrypt my disk. What exactly does using these signed images get me in additional security? How trivial is it to generate a "signed" EFI kernel image which is compromised?
With your unencrypted boot partition, malware could theoretically replace your unsigned kernel with its own (say, a hypervisor running your original kernel). This malware would then be undetectable by your system, while having full access to it.
A signed kernel closes this hole, at least in theory: since the malware hypervisor isn't be signed, a EFI BIOS that requires a signed OS would refuse to load it.
The problem with this is that while a random malware author isn't likely to have a signing key recognized by your BIOS, a state-level actor is, and there's a decent chance that an author working for organized crime will.
