Microsoft is now selling ARM-Based Windows 10 Machines

“Requirement 10: OPTIONAL. An OEM may implement the ability for a physically present user to turn off Secure Boot either with access to the PKpriv or with Physical Presence through the firmware setup.“

https://docs.microsoft.com/en-us/windows-hardware/drivers/br...

EDIT: It looks like these two come with windows locked in S mode. I don’t know if that impacts the bootloader, but the stock OS is limited to windows store apps I think.