I would imagine secureboot work this way - you start machine, UEFI detects that signature of bootloader or kernel or whatever fails signature verification. If it fails - ask user if he wants to save new signature instead or if he did not install any updates to kernel/boot/etc.
This way it will be:
- universally between OSes
- will allow GPL code to be used
- will not lock people into particular software platform