-<li><b>From the OS</b>—You can add a key by modifying the EFI NVRAM variables located in <tt>/sys/firmware/efi/vars</tt>. When the computer reboots, shim will detect the change and ask for verification about enrollment of the new key.</li>
+<li>rEFInd can launch <i>one</i> shim/MOK-signed driver, no more. If you
+ try to launch two drivers, rEFInd throws up an <tt>Access Denied</tt>
+ error for the second driver.</li>
+
+<li>ELILO can't find its configuration file when launched from rEFInd in
+ Secure Boot mode. The same may be true of GRUB or other boot loaders,
+ but I haven't tested them.</li>
+
+<li>Under certain circumstances, the time required to launch a boot loader
+ can increase. This is unlikely to be noticeable for the average small
+ boot loader, but could be significant for larger boot loaders on slow
+ filesystems, such as Linux kernels on ext2fs, ext3fs, or ReiserFS
+ partitions.</li>
+
+<li>I haven't tested launching Windows from rEFInd in Secure Boot mode.
+ This is admittedly a huge omission; but I don't have a suitable
+ installation for testing.</li>