you can also enroll your own key relatively easily using mokutil
if you're building your own kernels it's one command to sign them (sbsign)
The MS link appears to say that you need UEFI that is Secure Boot capable. That includes most implementations.
If you have Bitlocker enabled, all bets are off. Make sure you have a recovery key set up.
I signed linux and it's just fine, debian does it transparently now.
There's no way Windows _NEEDS_ to be signed to boot. Even macOS doesn't complain that much when booted without Secure Boot. Perhaps someone will find a way to cheat Windows about SecureBoot or TPM by using OpenCore, like the Hackintosh community has been doing for a long time.
I already know where microsoft is going with this - Xbox-like DRM. In a few years they'll probably release pci-e based "security devices" with full DMA privileges, too.