Comment 47 for bug 1401532

The last comment from Mathieu is still the current status. We have not toggled signature enforcement for xenial yet because we have a Canonical-supported kernel, linux-fips, which is published for xenial and there is not yet a version of this kernel which is both FIPS-certified and EFI signed.

The process of certifying a new kernel takes some time and depends on external entities.

We are currently still in a holding pattern waiting for that external certification to be completed.