The situation isn’t as grave as it may sound, since it is possible to turn off secure boot on x86 hardware, and even possible to get another boot loader signed by Microsoft. However while this is feasible for larger distros, for the smaller ones, this can be tougher problem.
Luckily there is now a solution for this as well and it is available for any distro to adopt. The solution manages to bypass the restriction imposed by Secure Boot in not booting code that is not signed by a trusted authority while still providing the kind of security secure boot does.
The way it works is by having a pre-bootloader shim that boots the actual boot loader. This boot loader is itself signed by Microsoft, and made available to all distros.
What this pre-boot loader does is to check if the real boot loader is signed by a supported key, just like Secure Boot does. However it also lets users enroll their own keys, allowing them to enrol’ the keys of any distro they want to boot into.
A small distro can then sign its own boot loader and provide the key on the install disk, allowing the user to choose what to trust rather than having the computer manufacturer choose that for them.
You can read more about this solution on this blog post by Matthew Garrett
