The thing about secure boot is that it is a GOOD idea done very badly indeed. What was needed was for a trusted neutral party(or two) to be the owner of the root key, and for that organisation to hand out child keys (e.g. Microsoft, Open Source Initiative, Apple, etc) who could in turn generate child keys (all of which could be revoked). Essentially we need the "internet model" of key exchanges for this too. I cannot…
The real use for secure boot is within a single company/organization where you want to control exactly what runs on the computers you own. That's an argument for secure boot to be switched off by default, and for the companies that want it to manage their own keys.
Although Microsoft will now point at me and say "but, but we need to prevent boot sector viruses!" it's telling that no other operating system except Windows commonly suffers from this problem.