If re-flashing UEFI is such a problem, why can't we make reflashing UEFI easier? Board manufacturers have done that for re-flashing the BIOS for some of their motherboards.

Without being able to re-flash the UEFI, a lot of the smaller Linux distributions are going to disappear, as they will not be able to afford the expense of purchasing certificates.

And what will this do to virtualization software? What about those of us running other OSes in vms?