Here's my rant on how Secure boot should be done. Currently, you have Microsoft's public key certificates in the firmware, and you can either boot with secure boot on or off. I would rather that the certificates be treated similar to a web browsers, where you have a list of "official" certs belonging to multiple independent entities. In addition, when in secure mode, you shouldn't be able to boot from unsigned media.

Now here's where I think this can be improved. Usually, hitting something like F12 at boot time gives you a list of devices to boot from (internal drive, USB devices, DVD, network, etc). What I'd like to see added to this is an item labeled "Boot from unsigned DVD/USB/Network [for OS installation mode]". Once this is selected, whatever you boot would have access to adding additional certificates to the firmware. Or, more appropriately, you should be able to select 3 boot options: 1) boot from signed media; 2) boot from unsigned media; 3) boot from unsigned media with write access to certificate key store [OS installation mode]. That way, the end user can still maintain complete control over their hardware, yet still get the benefits of protection against boot sector malware / low level root kits.