there were some pretty deep shenanigans in ventoy not too long ago.

https://news.ycombinator.com/item?id=44810281

This was pretty wild too: https://github.com/ventoy/PXE/issues/106 that's where they installed a self-signed EV cert in the trust store.