Secure boot is nice. Anyone who disagrees is delusional. The only issue here is the fact that by default only vendor and Microsoft keys are enrolled. You can roll your own but it’s painful.