[bluehavana]

Turning off secure boot is only required for x86 and the actual article (at mjg59.dreamwidth.org) says "in case you don't want to fiddle with firmware settings."

So for Arm you would still need a signed boot loader.