https://docs.microsoft.com/en-us/windows/security/informatio...
>All x86-based Certified For Windows 10 PCs must meet several requirements related to Secure Boot:
> - They must have Secure Boot enabled by default.
> - They must trust Microsoft’s certificate (and thus any bootloader Microsoft has signed).
> - They must allow the user to configure Secure Boot to trust other bootloaders.
> - They must allow the user to completely disable Secure Boot.
The last two points in particular. It's been this way since SB was introduced.
Note that this requirement does not apply to non-x86 devices. In particular, ARM devices (Windows RT) are explicitly required to disallow SB from being disabled, to meet the certification requirement.
This one in particular always pissed me off, and I'm glad it only applies to pre-built machines that come with Windows 10 preinstalled. If the individual motherboard makers ever decide they need to be "certified for Windows 10" and start auto-trusting a certificate for closed-source commercial software, I'm left with no choice but to either stick with my "old" (not really that old) hardware or switch to another platform like POWER9.
