The intent makes sense, it is a trust chain to ensure the system will only boot if it is not tempered with. We have it on android also, to prevent malicious Kernel and OS changes. Microsoft holding the keys signing is the shit part.