> all the secureboot implementations I've seen allow you to either disable it or enroll your own keys

Here you go — now you have. Thank ${DEITY} for exploits!

https://wiki.ubuntu.com/ARM/SurfaceRT#Secure_Boot

https://openrt.gitbook.io/open-surfacert/common/boot-sequenc...