Microsoft’s Secure Boot has been broken for a decade and no one noticed until now
(www.welivesecurity.com)
You should be able to remove any or all the certs as well, although I could see an argument for requiring you to enter the BIOS to do that.