[meepmorp]

But secure boot is a good thing! I want my machines to verify what they're loading at boot time!

I just want to specify the root of trust.

[yyyk]

There's mokutil to add your own key.

[csdvrx]

no, a mok is just adding an unprotected UEFI variable. It's not the same as adding your key which can say disallow running payloads signed by Microsoft key.