Secure Boot uses digital key pairs to check that SystemTap and other startup code hasn’t been altered by a rootkit or similar mechanism.

Read More at Enable Sysadmin