Re: Not a problem @Cynic
UEFI is a BIOS replacement. It will always be in the ROM/Flash memory as a first stage bootstrap.
If you have the part of UEFI hard-coded so that only allows booting of a cryptographically signed OS from the media (and this is what WindowsRT mandated, it would not boot if UEFI was configured to be more relaxed), then you've got a chicken-and-egg situation where you can't break in to run another OS.
Microsoft insisted that WindowsRT systems were locked down like this because they did not want someone buying a Surface, and showing how well Android would run on the rather nice hardware.
As discussed before on these forums, the consensus is that one of the distro owners should provide a UEFI complient cryptographically signed Grub that could be booted to break the straight-jacket that was being planned by the Trusted Computing Group, or whatever it was last called.
A locked UEFI on a RiPi would be a complete disaster.