> "You forget to mention that secure boot can be disabled."
Correct. But the steps to do so vary wildly from motherboard to motherboard and are not documented anywhere.
In fact, one of the things HispaLinux requested is that OEMs provide clear documentation of the technical steps required to disable SecureBoot.