Exactly, this is exactly what I'm going to do on NixOS. Apparently Epic is greenlighting CachyOS, so I'll most likely just pull their bins.

> GP: EACv2 can't accept self-signed kernels and bootloaders

Also, from what I understand from the NixOS discussion[1] on this, it's using mok. That does put which keys are trusted in Epic's hands (which also isn't perfect, but is still vastly better than Microsoft). That article author seems to be poorly informed, or may be spreading FUD.

[1]: https://discourse.nixos.org/t/eac-linux-v2-requirements-vs-b...