All I know about secure boot is that if I make a custom ISO and try booting from it, I would need to create a signature first, register it in my UEFI, and use it to sign the ISO.

Seems like a pain in the ass, but then again if I want to play with a custom ISO I can do so in a VM, and that seems kind of worth it to prevent someone from booting whateverthefuck if they somehow gain physical access to my computer…