In this case it is an option, you can still disable UEFI Secure Boot, re-enable the UEFI CA and enroll your own keys. The only thing that changes is a default in an option you would need to alter in any case if you wanted to control the boot yourself.