Having to get the client into call just so they go and click authorisation for adding some signing keys on VMs (as it was in pre-boot stage) just to add some driver wasn't fun
What an awful system