An important detail which doesn't change what you are saying: Secure Boot is from the UEFI specification, but I think SB is optional.