> the reference implementation and all known shipping versions of secure boot have a switch to disable it if the user so chooses

Matthew Garrett reported a while back[1] that some vendors will not provide an option to disable secure boot.

[1] http://mjg59.dreamwidth.org/5850.html